02_exploitdb_EDA.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "import os\n",
    "import pickle\n",
    "import glob\n",
    "from tqdm import tqdm\n",
    "import numpy as np"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Exploit DB Metadat"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "ename": "ModuleNotFoundError",
     "evalue": "No module named 'numpy.core._multiarray_umath'",
     "output_type": "error",
     "traceback": [
      "\u001b[0;31m---------------------------------------------------------------------------\u001b[0m",
      "\u001b[0;31mModuleNotFoundError\u001b[0m                       Traceback (most recent call last)",
      "\u001b[0;31mModuleNotFoundError\u001b[0m: No module named 'numpy.core._multiarray_umath'"
     ]
    },
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>url</th>\n",
       "      <th>CVE</th>\n",
       "      <th>Verified</th>\n",
       "      <th>Type</th>\n",
       "      <th>HasApplication</th>\n",
       "      <th>Platform</th>\n",
       "      <th>Date</th>\n",
       "      <th>Critical</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>https://www.exploit-db.com/exploits/15501</td>\n",
       "      <td>CVE-2010-4837</td>\n",
       "      <td>1</td>\n",
       "      <td>webapps</td>\n",
       "      <td>0</td>\n",
       "      <td>PHP</td>\n",
       "      <td>2010-11-12</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>https://www.exploit-db.com/exploits/44028</td>\n",
       "      <td>CVE-2018-6889</td>\n",
       "      <td>0</td>\n",
       "      <td>webapps</td>\n",
       "      <td>0</td>\n",
       "      <td>PHP</td>\n",
       "      <td>2018-02-13</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>https://www.exploit-db.com/exploits/7046</td>\n",
       "      <td>CVE-2008-5654</td>\n",
       "      <td>1</td>\n",
       "      <td>webapps</td>\n",
       "      <td>0</td>\n",
       "      <td>PHP</td>\n",
       "      <td>2008-11-07</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>https://www.exploit-db.com/exploits/24904</td>\n",
       "      <td>CVE-2013-1493</td>\n",
       "      <td>1</td>\n",
       "      <td>remote</td>\n",
       "      <td>0</td>\n",
       "      <td>Windows</td>\n",
       "      <td>2013-03-29</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>https://www.exploit-db.com/shellcodes/43747</td>\n",
       "      <td>NaN</td>\n",
       "      <td>0</td>\n",
       "      <td>shellcode</td>\n",
       "      <td>0</td>\n",
       "      <td>Linux_x86</td>\n",
       "      <td>2009-01-01</td>\n",
       "      <td>0</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                            url            CVE  Verified  \\\n",
       "0     https://www.exploit-db.com/exploits/15501  CVE-2010-4837         1   \n",
       "1     https://www.exploit-db.com/exploits/44028  CVE-2018-6889         0   \n",
       "2      https://www.exploit-db.com/exploits/7046  CVE-2008-5654         1   \n",
       "3     https://www.exploit-db.com/exploits/24904  CVE-2013-1493         1   \n",
       "4   https://www.exploit-db.com/shellcodes/43747            NaN         0   \n",
       "\n",
       "        Type  HasApplication   Platform        Date  Critical  \n",
       "0    webapps               0        PHP  2010-11-12         0  \n",
       "1    webapps               0        PHP  2018-02-13         0  \n",
       "2    webapps               0        PHP  2008-11-07         0  \n",
       "3     remote               0    Windows  2013-03-29         0  \n",
       "4  shellcode               0  Linux_x86  2009-01-01         0  "
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df = pd.read_csv(os.path.join('data', 'exploitdb_metadata.csv'), index_col=0)\n",
    "\n",
    "#we can disregard URL\n",
    "exploitdb_df['CVE'] = exploitdb_df['CVE'].str.split('/').str[-1]\n",
    "\n",
    "\n",
    "exploitdb_df[exploitdb_df.select_dtypes(include=bool).columns] *= 1\n",
    "\n",
    "exploitdb_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['url', 'CVE', 'Verified', 'Type', 'HasApplication', 'Platform', 'Date',\n",
       "       'Critical'],\n",
       "      dtype='object')"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df.columns"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Verified          0.770134\n",
       "HasApplication    0.179356\n",
       "Critical          0.127373\n",
       "dtype: float64"
      ]
     },
     "execution_count": 4,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#see averages in booleans\n",
    "exploitdb_df.mean()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "url               0.000000\n",
       "CVE               0.416230\n",
       "Verified          0.000000\n",
       "Type              0.002404\n",
       "HasApplication    0.000000\n",
       "Platform          0.002404\n",
       "Date              0.002404\n",
       "Critical          0.000000\n",
       "dtype: float64"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#percent missing\n",
    "exploitdb_df.isna().mean()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "21230"
      ]
     },
     "execution_count": 6,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df['CVE'].nunique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "webapps      24771\n",
       "remote        7069\n",
       "dos           6740\n",
       "local         4379\n",
       "shellcode     1026\n",
       "Name: Type, dtype: int64"
      ]
     },
     "execution_count": 7,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df['Type'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "71"
      ]
     },
     "execution_count": 8,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df['Platform'].nunique()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PHP          20453\n",
       "Windows       9785\n",
       "Linux         2969\n",
       "Multiple      2733\n",
       "Hardware      1807\n",
       "ASP           1539\n",
       "CGI            775\n",
       "Linux_x86      500\n",
       "Unix           322\n",
       "OSX            316\n",
       "Name: Platform, dtype: int64"
      ]
     },
     "execution_count": 9,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df['Platform'].value_counts()[:10]"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PHP         20453\n",
       "Windows      9785\n",
       "Linux        2969\n",
       "Multiple     2733\n",
       "Hardware     1807\n",
       "            ...  \n",
       "UnixWare        4\n",
       "BSDi_x86        3\n",
       "NodeJS          3\n",
       "Lua             2\n",
       "ULTRIX          2\n",
       "Name: Platform, Length: 61, dtype: int64"
      ]
     },
     "execution_count": 10,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_df['Platform'].value_counts()[:-10]"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Exploit DB Critical CVEs"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>url</th>\n",
       "      <th>CVE</th>\n",
       "      <th>Verified</th>\n",
       "      <th>Type</th>\n",
       "      <th>HasApplication</th>\n",
       "      <th>Platform</th>\n",
       "      <th>Date</th>\n",
       "      <th>Critical</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>https://www.exploit-db.com/exploits/5889</td>\n",
       "      <td>CVE-2008-2890</td>\n",
       "      <td>1</td>\n",
       "      <td>webapps</td>\n",
       "      <td>1</td>\n",
       "      <td>PHP</td>\n",
       "      <td>2008-06-21</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>https://www.exploit-db.com/exploits/2880</td>\n",
       "      <td>CVE-2009-0450</td>\n",
       "      <td>1</td>\n",
       "      <td>local</td>\n",
       "      <td>1</td>\n",
       "      <td>Windows</td>\n",
       "      <td>2006-12-01</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>https://www.exploit-db.com/exploits/40528</td>\n",
       "      <td>NaN</td>\n",
       "      <td>1</td>\n",
       "      <td>local</td>\n",
       "      <td>1</td>\n",
       "      <td>Windows</td>\n",
       "      <td>2016-10-13</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>33</th>\n",
       "      <td>https://www.exploit-db.com/exploits/5137</td>\n",
       "      <td>CVE-2008-0813</td>\n",
       "      <td>1</td>\n",
       "      <td>webapps</td>\n",
       "      <td>1</td>\n",
       "      <td>PHP</td>\n",
       "      <td>2008-02-17</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>37</th>\n",
       "      <td>https://www.exploit-db.com/exploits/32800</td>\n",
       "      <td>CVE-2009-0756</td>\n",
       "      <td>1</td>\n",
       "      <td>dos</td>\n",
       "      <td>1</td>\n",
       "      <td>Linux</td>\n",
       "      <td>2009-02-12</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                                           url            CVE  Verified  \\\n",
       "13    https://www.exploit-db.com/exploits/5889  CVE-2008-2890         1   \n",
       "23    https://www.exploit-db.com/exploits/2880  CVE-2009-0450         1   \n",
       "26   https://www.exploit-db.com/exploits/40528            NaN         1   \n",
       "33    https://www.exploit-db.com/exploits/5137  CVE-2008-0813         1   \n",
       "37   https://www.exploit-db.com/exploits/32800  CVE-2009-0756         1   \n",
       "\n",
       "       Type  HasApplication Platform        Date  Critical  \n",
       "13  webapps               1      PHP  2008-06-21         1  \n",
       "23    local               1  Windows  2006-12-01         1  \n",
       "26    local               1  Windows  2016-10-13         1  \n",
       "33  webapps               1      PHP  2008-02-17         1  \n",
       "37      dos               1    Linux  2009-02-12         1  "
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#get all that are verified and true and a CVE\n",
    "exploitdb_critical_df = exploitdb_df[exploitdb_df['Critical']==True]\n",
    "\n",
    "exploitdb_critical_df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "url               0.000000\n",
       "CVE               0.425392\n",
       "Verified          0.000000\n",
       "Type              0.000000\n",
       "HasApplication    0.000000\n",
       "Platform          0.000000\n",
       "Date              0.000000\n",
       "Critical          0.000000\n",
       "dtype: float64"
      ]
     },
     "execution_count": 12,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_critical_df.isna().mean()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "CVE-2006-4985    22\n",
       "CVE-2007-3217    12\n",
       "CVE-2006-3019    10\n",
       "CVE-2006-1205    10\n",
       "CVE-2008-3664     9\n",
       "                 ..\n",
       "CVE-2009-5141     1\n",
       "CVE-2015-7347     1\n",
       "CVE-2008-0742     1\n",
       "CVE-2006-5284     1\n",
       "CVE-2007-1251     1\n",
       "Name: CVE, Length: 2509, dtype: int64"
      ]
     },
     "execution_count": 13,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "#any over represented CVE?\n",
    "exploitdb_critical_df['CVE'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "webapps    2811\n",
       "remote     1023\n",
       "dos         953\n",
       "local       829\n",
       "Name: Type, dtype: int64"
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_critical_df['Type'].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "PHP               2718\n",
       "Windows           2027\n",
       "Linux              470\n",
       "Multiple           179\n",
       "ASP                 65\n",
       "Windows_x86         42\n",
       "CGI                 24\n",
       "Windows_x86-64      22\n",
       "OSX                 17\n",
       "Unix                17\n",
       "BSD                  8\n",
       "JSP                  5\n",
       "Linux_x86            4\n",
       "Java                 4\n",
       "Solaris              3\n",
       "AIX                  3\n",
       "Python               3\n",
       "Linux_x86-64         1\n",
       "Ruby                 1\n",
       "FreeBSD              1\n",
       "ASPX                 1\n",
       "Android              1\n",
       "Name: Platform, dtype: int64"
      ]
     },
     "execution_count": 15,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "exploitdb_critical_df['Platform'].value_counts()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## 2 Sided KS Test\n",
    "\n",
    "Hypothesis: Are the types following the same distributions?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [],
   "source": [
    "from scipy import stats\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Ks_2sampResult(statistic=1.0, pvalue=0.028571428571428577)"
      ]
     },
     "execution_count": 17,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "merged_type_ks = pd.merge(exploitdb_df['Type'].value_counts().to_frame(), \n",
    "                     exploitdb_critical_df['Type'].value_counts().to_frame(),\n",
    "                          suffixes= ('_all', '_critical'),\n",
    "                          left_index=True, \n",
    "                          right_index=True)\n",
    "\n",
    "stats.ks_2samp(merged_type_ks['Type_all'], merged_type_ks['Type_critical'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 18,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>Type_all</th>\n",
       "      <th>Type_critical</th>\n",
       "      <th>ratio_diff</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>webapps</th>\n",
       "      <td>24771</td>\n",
       "      <td>2811</td>\n",
       "      <td>0.113479</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>remote</th>\n",
       "      <td>7069</td>\n",
       "      <td>1023</td>\n",
       "      <td>0.144716</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>dos</th>\n",
       "      <td>6740</td>\n",
       "      <td>953</td>\n",
       "      <td>0.141395</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>local</th>\n",
       "      <td>4379</td>\n",
       "      <td>829</td>\n",
       "      <td>0.189313</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "         Type_all  Type_critical  ratio_diff\n",
       "webapps     24771           2811    0.113479\n",
       "remote       7069           1023    0.144716\n",
       "dos          6740            953    0.141395\n",
       "local        4379            829    0.189313"
      ]
     },
     "execution_count": 18,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "merged_type_ks['ratio_diff'] = (merged_type_ks['Type_critical'] / merged_type_ks['Type_all'])\n",
    "\n",
    "merged_type_ks.sort_values(by='ratio_diff', ascending=False)\n",
    "\n",
    "merged_type_ks.head(10)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Hypothesis: Are the platforms following the same distributions?"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 19,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Ks_2sampResult(statistic=0.6818181818181818, pvalue=3.642468216632747e-05)"
      ]
     },
     "execution_count": 19,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "merged_platform_ks = pd.merge(exploitdb_df['Platform'].value_counts().to_frame(), \n",
    "                     exploitdb_critical_df['Platform'].value_counts().to_frame(),\n",
    "                          suffixes= ('_all', '_critical'),\n",
    "                          left_index=True, \n",
    "                          right_index=True)\n",
    "\n",
    "stats.ks_2samp(merged_platform_ks['Platform_all'], merged_platform_ks['Platform_critical'])"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 22,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "Index(['CVE', 'Date'], dtype='object')"
      ]
     },
     "execution_count": 22,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}