Add CNN_Patron_WL.ipynb

notebooks/CNN_Patron_WL.ipynb

@@ -0,0 +1,646 @@
+{
+  "nbformat": 4,
+  "nbformat_minor": 0,
+  "metadata": {
+    "colab": {
+      "provenance": [],
+      "gpuType": "T4"
+    },
+    "kernelspec": {
+      "name": "python3",
+      "display_name": "Python 3"
+    },
+    "language_info": {
+      "name": "python"
+    },
+    "accelerator": "GPU"
+  },
+  "cells": [
+    {
+      "cell_type": "code",
+      "source": [
+        "from google.colab import drive  # Importing the library to mount Google Drive\n",
+        "drive.mount('/content/drive')  # Mounting Google Drive in Colab environment"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "71FJxLKc1343",
+        "outputId": "b6eae6c8-c52a-47b1-d5e9-8f43bf78cf31"
+      },
+      "execution_count": 1,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "Mounted at /content/drive\n"
+          ]
+        }
+      ]
+    },
+    {
+      "cell_type": "code",
+      "execution_count": 2,
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "YXAm488r1DJw",
+        "outputId": "8d425156-f6c8-4474-ebf7-0fc11e009675"
+      },
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "                       domain    family   Label\n",
+            "0         nailconsiderable.ru  suppobox     dga\n",
+            "1            stilldelight.net  suppobox     dga\n",
+            "2       kimberleekatheryn.net  suppobox     dga\n",
+            "3                soilbeen.net  suppobox     dga\n",
+            "4               visitform.net  suppobox     dga\n",
+            "...                       ...       ...     ...\n",
+            "159995             dhuhaa.com     legit  notdga\n",
+            "159996        sdmetalcrew.org     legit  notdga\n",
+            "159997  melbcampcontuligol.ga     legit  notdga\n",
+            "159998      pl-enthusiast.net     legit  notdga\n",
+            "159999            rd-forum.ru     legit  notdga\n",
+            "\n",
+            "[160000 rows x 3 columns]\n"
+          ]
+        }
+      ],
+      "source": [
+        "import pandas as pd\n",
+        "\n",
+        "# File paths\n",
+        "train_df_file = \"/content/drive/My Drive/MOE_DGA/train_wl.csv\"\n",
+        "\n",
+        "train_df = pd.read_csv(train_df_file)\n",
+        "\n",
+        "train_df = train_df.rename(columns={\"label\": \"Label\"})\n",
+        "\n",
+        "\n",
+        "print(train_df)"
+      ]
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "# 📦 Instalar PyTorch si hace falta (Colab ya lo trae normalmente)\n",
+        "# !pip install torch torchvision scikit-learn pandas\n",
+        "\n",
+        "# 📚 1. Importar librerías\n",
+        "import torch\n",
+        "import torch.nn as nn\n",
+        "import torch.optim as optim\n",
+        "from torch.utils.data import Dataset, DataLoader\n",
+        "from sklearn.model_selection import train_test_split\n",
+        "from sklearn.metrics import classification_report\n",
+        "import pandas as pd\n",
+        "import numpy as np\n",
+        "import string\n",
+        "\n",
+        "# 📐 2. Definir preprocesamiento de texto\n",
+        "CHARS = string.ascii_lowercase + string.digits + \"-._\"\n",
+        "CHAR2IDX = {c: i+1 for i, c in enumerate(CHARS)}  # 0 para padding\n",
+        "MAXLEN = 75  # Longitud máxima del dominio\n",
+        "\n",
+        "def encode_domain(domain):\n",
+        "    domain = domain.lower()\n",
+        "    return [CHAR2IDX.get(c, 0) for c in domain[:MAXLEN]] + [0] * (MAXLEN - len(domain))\n",
+        "\n",
+        "# 🧹 3. Dataset personalizado\n",
+        "class DGADataset(Dataset):\n",
+        "    def __init__(self, df):\n",
+        "        self.domains = [encode_domain(d) for d in df[\"domain\"]]\n",
+        "        self.labels = [1 if label == \"dga\" else 0 for label in df[\"Label\"]]\n",
+        "\n",
+        "    def __len__(self):\n",
+        "        return len(self.domains)\n",
+        "\n",
+        "    def __getitem__(self, idx):\n",
+        "        return torch.tensor(self.domains[idx], dtype=torch.long), torch.tensor(self.labels[idx], dtype=torch.long)\n",
+        "\n",
+        "# 🧠 4. Modelo CNN\n",
+        "class DGACNN(nn.Module):\n",
+        "    def __init__(self, vocab_size, embedding_dim=32, num_classes=2):\n",
+        "        super().__init__()\n",
+        "        self.embedding = nn.Embedding(vocab_size, embedding_dim, padding_idx=0)\n",
+        "        self.conv1 = nn.Conv1d(embedding_dim, 64, kernel_size=3, padding=1)\n",
+        "        self.relu = nn.ReLU()\n",
+        "        self.pool = nn.MaxPool1d(2)\n",
+        "        self.dropout = nn.Dropout(0.3)\n",
+        "        self.fc = nn.Linear(64 * (MAXLEN // 2), num_classes)\n",
+        "\n",
+        "    def forward(self, x):\n",
+        "        x = self.embedding(x).transpose(1, 2)\n",
+        "        x = self.pool(self.relu(self.conv1(x)))\n",
+        "        x = x.view(x.size(0), -1)\n",
+        "        x = self.dropout(x)\n",
+        "        return self.fc(x)\n",
+        "\n",
+        "# 🏋️‍♂️ 5. Función de entrenamiento\n",
+        "def train_model(model, dataloader, epochs=3, lr=1e-3):\n",
+        "    criterion = nn.CrossEntropyLoss()\n",
+        "    optimizer = optim.Adam(model.parameters(), lr=lr)\n",
+        "    model.train()\n",
+        "\n",
+        "    for epoch in range(epochs):\n",
+        "        total_loss, correct = 0, 0\n",
+        "        for x_batch, y_batch in dataloader:\n",
+        "            x_batch, y_batch = x_batch.to(device), y_batch.to(device)\n",
+        "            outputs = model(x_batch)\n",
+        "            loss = criterion(outputs, y_batch)\n",
+        "            optimizer.zero_grad()\n",
+        "            loss.backward()\n",
+        "            optimizer.step()\n",
+        "\n",
+        "            total_loss += loss.item()\n",
+        "            correct += (outputs.argmax(1) == y_batch).sum().item()\n",
+        "\n",
+        "        acc = correct / len(dataloader.dataset)\n",
+        "        print(f\"📈 Epoch {epoch+1}: Loss={total_loss:.4f}, Accuracy={acc:.4f}\")\n",
+        "\n",
+        "# 🧪 6. Evaluación\n",
+        "def evaluate_model(model, dataloader):\n",
+        "    model.eval()\n",
+        "    y_true, y_pred = [], []\n",
+        "    with torch.no_grad():\n",
+        "        for x, y in dataloader:\n",
+        "            x, y = x.to(device), y.to(device)\n",
+        "            outputs = model(x)\n",
+        "            preds = outputs.argmax(dim=1)\n",
+        "            y_true.extend(y.cpu().numpy())\n",
+        "            y_pred.extend(preds.cpu().numpy())\n",
+        "\n",
+        "    print(\"\\n📊 Classification Report:\\n\")\n",
+        "    print(classification_report(y_true, y_pred, target_names=[\"notdga\", \"dga\"]))\n",
+        "\n",
+        "# ⚙️ 7. Preparar datos (cargar tu DataFrame aquí)\n",
+        "# 👇 Reemplaza esto con tu método real para cargar train_df\n",
+        "# train_df = pd.read_csv(\"tu_archivo.csv\")\n",
+        "# o si ya está en memoria, asegúrate de que se llame 'train_df'\n",
+        "\n",
+        "train_df = train_df.rename(columns={\"Labels\": \"Label\"})  # Normalizar nombre de columna\n",
+        "\n",
+        "train_data, test_data = train_test_split(train_df, test_size=0.02, stratify=train_df[\"Label\"], random_state=42)\n",
+        "train_loader = DataLoader(DGADataset(train_data), batch_size=64, shuffle=True)\n",
+        "test_loader = DataLoader(DGADataset(test_data), batch_size=64)\n",
+        "\n",
+        "# 🚀 8. Entrenar y evaluar\n",
+        "device = torch.device(\"cuda\" if torch.cuda.is_available() else \"cpu\")\n",
+        "model = DGACNN(vocab_size=len(CHAR2IDX)+1).to(device)\n",
+        "\n",
+        "train_model(model, train_loader, epochs=50)\n",
+        "evaluate_model(model, test_loader)\n",
+        "\n",
+        "# 💾 9. Guardar modelo entrenado (opcional)\n",
+        "torch.save(model.state_dict(), \"dga_cnn_model_wl.pth\")\n",
+        "\n"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "kEk4Sbxf1_8n",
+        "outputId": "5938dc14-9f67-4794-c2c8-8229ac56b37b"
+      },
+      "execution_count": 3,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "📈 Epoch 1: Loss=1227.4861, Accuracy=0.7598\n",
+            "📈 Epoch 2: Loss=1111.8431, Accuracy=0.7938\n",
+            "📈 Epoch 3: Loss=1085.7899, Accuracy=0.8011\n",
+            "📈 Epoch 4: Loss=1065.8432, Accuracy=0.8062\n",
+            "📈 Epoch 5: Loss=1053.0915, Accuracy=0.8091\n",
+            "📈 Epoch 6: Loss=1043.4482, Accuracy=0.8117\n",
+            "📈 Epoch 7: Loss=1037.5315, Accuracy=0.8147\n",
+            "📈 Epoch 8: Loss=1029.9196, Accuracy=0.8156\n",
+            "📈 Epoch 9: Loss=1029.8009, Accuracy=0.8168\n",
+            "📈 Epoch 10: Loss=1021.3644, Accuracy=0.8175\n",
+            "📈 Epoch 11: Loss=1018.4461, Accuracy=0.8186\n",
+            "📈 Epoch 12: Loss=1015.0625, Accuracy=0.8189\n",
+            "📈 Epoch 13: Loss=1011.4315, Accuracy=0.8195\n",
+            "📈 Epoch 14: Loss=1007.4491, Accuracy=0.8208\n",
+            "📈 Epoch 15: Loss=1008.6686, Accuracy=0.8221\n",
+            "📈 Epoch 16: Loss=1002.7266, Accuracy=0.8218\n",
+            "📈 Epoch 17: Loss=1003.0112, Accuracy=0.8230\n",
+            "📈 Epoch 18: Loss=1001.5669, Accuracy=0.8233\n",
+            "📈 Epoch 19: Loss=998.4341, Accuracy=0.8238\n",
+            "📈 Epoch 20: Loss=999.5484, Accuracy=0.8229\n",
+            "📈 Epoch 21: Loss=996.5214, Accuracy=0.8238\n",
+            "📈 Epoch 22: Loss=995.0207, Accuracy=0.8244\n",
+            "📈 Epoch 23: Loss=990.1331, Accuracy=0.8265\n",
+            "📈 Epoch 24: Loss=990.1392, Accuracy=0.8263\n",
+            "📈 Epoch 25: Loss=992.0144, Accuracy=0.8248\n",
+            "📈 Epoch 26: Loss=986.3864, Accuracy=0.8256\n",
+            "📈 Epoch 27: Loss=990.5259, Accuracy=0.8248\n",
+            "📈 Epoch 28: Loss=992.1301, Accuracy=0.8242\n",
+            "📈 Epoch 29: Loss=984.8474, Accuracy=0.8265\n",
+            "📈 Epoch 30: Loss=985.9777, Accuracy=0.8260\n",
+            "📈 Epoch 31: Loss=984.4458, Accuracy=0.8269\n",
+            "📈 Epoch 32: Loss=982.8169, Accuracy=0.8269\n",
+            "📈 Epoch 33: Loss=982.3414, Accuracy=0.8271\n",
+            "📈 Epoch 34: Loss=981.2389, Accuracy=0.8268\n",
+            "📈 Epoch 35: Loss=979.3540, Accuracy=0.8266\n",
+            "📈 Epoch 36: Loss=978.4779, Accuracy=0.8277\n",
+            "📈 Epoch 37: Loss=977.5119, Accuracy=0.8283\n",
+            "📈 Epoch 38: Loss=977.7488, Accuracy=0.8276\n",
+            "📈 Epoch 39: Loss=978.3020, Accuracy=0.8291\n",
+            "📈 Epoch 40: Loss=976.9651, Accuracy=0.8282\n",
+            "📈 Epoch 41: Loss=977.0974, Accuracy=0.8281\n",
+            "📈 Epoch 42: Loss=975.9940, Accuracy=0.8289\n",
+            "📈 Epoch 43: Loss=973.7795, Accuracy=0.8290\n",
+            "📈 Epoch 44: Loss=976.7709, Accuracy=0.8290\n",
+            "📈 Epoch 45: Loss=972.3411, Accuracy=0.8291\n",
+            "📈 Epoch 46: Loss=971.9982, Accuracy=0.8302\n",
+            "📈 Epoch 47: Loss=974.0462, Accuracy=0.8289\n",
+            "📈 Epoch 48: Loss=972.3418, Accuracy=0.8291\n",
+            "📈 Epoch 49: Loss=973.1150, Accuracy=0.8294\n",
+            "📈 Epoch 50: Loss=970.1658, Accuracy=0.8295\n",
+            "\n",
+            "📊 Classification Report:\n",
+            "\n",
+            "              precision    recall  f1-score   support\n",
+            "\n",
+            "      notdga       0.82      0.87      0.85      1600\n",
+            "         dga       0.86      0.81      0.83      1600\n",
+            "\n",
+            "    accuracy                           0.84      3200\n",
+            "   macro avg       0.84      0.84      0.84      3200\n",
+            "weighted avg       0.84      0.84      0.84      3200\n",
+            "\n"
+          ]
+        }
+      ]
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "def predict_domain(model, domain_name):\n",
+        "    model.eval()\n",
+        "    encoded = encode_domain(domain_name)\n",
+        "    input_tensor = torch.tensor([encoded], dtype=torch.long).to(device)\n",
+        "\n",
+        "    with torch.no_grad():\n",
+        "        output = model(input_tensor)\n",
+        "        prediction = torch.argmax(output, dim=1).item()\n",
+        "\n",
+        "    return \"dga\" if prediction == 1 else \"notdga\"\n"
+      ],
+      "metadata": {
+        "id": "42Qef2Y_9ISA"
+      },
+      "execution_count": 4,
+      "outputs": []
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "# Probar un dominio\n",
+        "test_domain = \"marca.com\"\n",
+        "result = predict_domain(model, test_domain)\n",
+        "print(f\"🔍 El dominio '{test_domain}' fue clasificado como: {result.upper()}\")\n"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "e_e8u_dR9KOh",
+        "outputId": "3ff44a27-085c-477e-827e-94e3556a3a56"
+      },
+      "execution_count": 5,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "🔍 El dominio 'marca.com' fue clasificado como: NOTDGA\n"
+          ]
+        }
+      ]
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "import time\n",
+        "from torch.utils.data import DataLoader\n",
+        "import gzip\n",
+        "\n",
+        "def predict_batch_with_timing(model, domains):\n",
+        "    model.eval()\n",
+        "    predictions = []\n",
+        "    timings = []\n",
+        "\n",
+        "    for domain in domains:\n",
+        "        start_time = time.time()\n",
+        "\n",
+        "        # Codificar y predecir dominio individual\n",
+        "        encoded = encode_domain(domain)\n",
+        "        inputs = torch.tensor([encoded], dtype=torch.long).to(device)\n",
+        "\n",
+        "        with torch.no_grad():\n",
+        "            outputs = model(inputs)\n",
+        "            pred = outputs.argmax(dim=1).cpu().numpy()[0]\n",
+        "\n",
+        "        end_time = time.time()\n",
+        "\n",
+        "        predictions.append(pred)\n",
+        "        timings.append(end_time - start_time)\n",
+        "\n",
+        "    return predictions, timings\n",
+        "\n",
+        "# Código principal modificado\n",
+        "families = [\n",
+        "    'matsnu.gz',\n",
+        "    'suppobox.gz',\n",
+        "    'charbot.gz',\n",
+        "    'gozi.gz',\n",
+        "    'manuelita.gz',\n",
+        "    'rovnix.gz',\n",
+        "    'deception.gz',\n",
+        "    'nymaim.gz'\n",
+        "]\n",
+        "\n",
+        "runs = 30\n",
+        "for family in families:\n",
+        "    print(f\"🔍 Procesando familia: {family}\")\n",
+        "    dga_reader = pd.read_csv(f'/content/drive/My Drive/Familias_Test/{family}', chunksize=50)\n",
+        "    legit_reader = pd.read_csv('/content/drive/My Drive/Familias_Test/legit.gz', chunksize=50)\n",
+        "\n",
+        "    for run in range(runs):\n",
+        "        print(f\" ▶️ Run {run+1}/{runs}\", end=\"\\r\")\n",
+        "        dga_chunk = dga_reader.get_chunk()\n",
+        "        legit_chunk = legit_reader.get_chunk()\n",
+        "        df_chunk = pd.concat([dga_chunk, legit_chunk]).reset_index(drop=True)\n",
+        "\n",
+        "        # Obtener predicciones y tiempos\n",
+        "        preds, times = predict_batch_with_timing(model, df_chunk[\"domain\"].values)\n",
+        "\n",
+        "        df_chunk[\"pred\"] = preds\n",
+        "        df_chunk[\"query_time\"] = times  # ✅ Tiempo por dominio\n",
+        "\n",
+        "        df_chunk.to_csv(\n",
+        "            f\"/content/drive/My Drive/results/results_CNN_PyTorch_{family}_{run}.csv.gz\",\n",
+        "            index=False,\n",
+        "            compression=\"gzip\"\n",
+        "        )\n"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "a2-uSZ0O-Jp-",
+        "outputId": "a54483c6-c0fe-48ce-93c1-44d5f91eacd6"
+      },
+      "execution_count": 6,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "🔍 Procesando familia: matsnu.gz\n",
+            "🔍 Procesando familia: suppobox.gz\n",
+            "🔍 Procesando familia: charbot.gz\n",
+            "🔍 Procesando familia: gozi.gz\n",
+            "🔍 Procesando familia: manuelita.gz\n",
+            "🔍 Procesando familia: rovnix.gz\n",
+            "🔍 Procesando familia: deception.gz\n",
+            "🔍 Procesando familia: nymaim.gz\n"
+          ]
+        }
+      ]
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "from torch.utils.data import DataLoader\n",
+        "import gzip\n",
+        "\n",
+        "def predict_batch_with_timing(model, domains):\n",
+        "    model.eval()\n",
+        "    predictions = []\n",
+        "    timings = []\n",
+        "\n",
+        "    for domain in domains:\n",
+        "        start_time = time.time()\n",
+        "\n",
+        "        # Codificar y predecir dominio individual\n",
+        "        encoded = encode_domain(domain)\n",
+        "        inputs = torch.tensor([encoded], dtype=torch.long).to(device)\n",
+        "\n",
+        "        with torch.no_grad():\n",
+        "            outputs = model(inputs)\n",
+        "            pred = outputs.argmax(dim=1).cpu().numpy()[0]\n",
+        "\n",
+        "        end_time = time.time()\n",
+        "\n",
+        "        predictions.append(pred)\n",
+        "        timings.append(end_time - start_time)\n",
+        "\n",
+        "    return predictions, timings\n",
+        "\n",
+        "\n",
+        "\n",
+        "families = ['bigviktor.gz',\n",
+        "            'pizd.gz',\n",
+        "            'ngioweb.gz'\n",
+        "\n",
+        "\n",
+        "           ]\n",
+        "\n",
+        "runs = 30\n",
+        "for family in families:\n",
+        "    print(f\"🔍 Procesando familia: {family}\")\n",
+        "\n",
+        "    dga_reader = pd.read_csv(f'/content/drive/My Drive/New_Families/{family}', chunksize=50)\n",
+        "    legit_reader = pd.read_csv('/content/drive/My Drive/Familias_Test/legit.gz', chunksize=50)\n",
+        "\n",
+        "    # Saltar los primeros 30 chunks de legit\n",
+        "    for _ in range(30):\n",
+        "        legit_reader.get_chunk()\n",
+        "\n",
+        "    for run in range(runs):\n",
+        "        print(f\" ▶️ Run {run+1}/{runs}\", end=\"\\r\")\n",
+        "        dga_chunk = dga_reader.get_chunk()\n",
+        "        legit_chunk = legit_reader.get_chunk()\n",
+        "        df_chunk = pd.concat([dga_chunk, legit_chunk]).reset_index(drop=True)\n",
+        "\n",
+        "        # Obtener predicciones y tiempos\n",
+        "        preds, times = predict_batch_with_timing(model, df_chunk[\"domain\"].values)\n",
+        "\n",
+        "        df_chunk[\"pred\"] = preds\n",
+        "        df_chunk[\"query_time\"] = times  # ✅ Tiempo por dominio\n",
+        "\n",
+        "        df_chunk.to_csv(\n",
+        "            f\"/content/drive/My Drive/results/results_CNN_PyTorch_{family}_{run}.csv.gz\",\n",
+        "            index=False,\n",
+        "            compression=\"gzip\"\n",
+        "        )\n",
+        "\n",
+        "\n",
+        "\n",
+        "\n"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "cB-p7y_5xn6G",
+        "outputId": "ebd3eaa1-a4fb-4e20-ccab-1a373f8bda40"
+      },
+      "execution_count": 7,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "🔍 Procesando familia: bigviktor.gz\n",
+            "🔍 Procesando familia: pizd.gz\n",
+            "🔍 Procesando familia: ngioweb.gz\n"
+          ]
+        }
+      ]
+    },
+    {
+      "cell_type": "code",
+      "source": [
+        "families = [\n",
+        "    'matsnu.gz',\n",
+        "    'suppobox.gz',\n",
+        "    'charbot.gz',\n",
+        "    'gozi.gz',\n",
+        "    'manuelita.gz',\n",
+        "    'rovnix.gz',\n",
+        "    'deception.gz',\n",
+        "    'nymaim.gz',\n",
+        "    'bigviktor.gz',\n",
+        "    'pizd.gz',\n",
+        "    'ngioweb.gz'\n",
+        "]\n",
+        "\n",
+        "from sklearn.metrics import accuracy_score, f1_score, recall_score, precision_score, confusion_matrix\n",
+        "import numpy as np\n",
+        "import pandas as pd\n",
+        "\n",
+        "def fpr_tpr(y, ypred):\n",
+        "    tn, fp, fn, tp = confusion_matrix(y, ypred).ravel()\n",
+        "    fpr = fp / (fp + tn) if (fp + tn) > 0 else 0\n",
+        "    tpr = tp / (tp + fn) if (tp + fn) > 0 else 0\n",
+        "    return fpr, tpr\n",
+        "\n",
+        "# Listas para métricas globales\n",
+        "all_acc, all_pre, all_rec, all_f1 = [], [], [], []\n",
+        "all_fpr, all_tpr, all_qt, all_qts = [], [], [], []\n",
+        "total_unknowns_global = 0\n",
+        "\n",
+        "\n",
+        "for family in families:\n",
+        "    acc = []\n",
+        "    pre = []\n",
+        "    rec = []\n",
+        "    f1 = []\n",
+        "    fpr = []\n",
+        "    tpr = []\n",
+        "    qt = []\n",
+        "    qts = []\n",
+        "    total_unknowns = 0\n",
+        "    for run in range(runs):\n",
+        "        path = f'/content/drive/My Drive/results/results_CNN_PyTorch_{family}_{run}.csv.gz'\n",
+        "        df = pd.read_csv(path)\n",
+        "        #print(df)\n",
+        "        y_true = (df[\"label\"] == 'dga').astype(int)\n",
+        "        y_pred = df[\"pred\"]\n",
+        "\n",
+        "                # Métricas\n",
+        "        acc.append(accuracy_score(y_true, y_pred))\n",
+        "        pre.append(precision_score(y_true, y_pred, zero_division=0))\n",
+        "        rec.append(recall_score(y_true, y_pred, zero_division=0))\n",
+        "        f1.append(f1_score(y_true, y_pred, zero_division=0))\n",
+        "        fpr_val, tpr_val = fpr_tpr(y_true, y_pred)\n",
+        "        fpr.append(fpr_val)\n",
+        "        tpr.append(tpr_val)\n",
+        "\n",
+        "        if 'query_time' in df.columns:\n",
+        "            qt.append(df['query_time'].mean())\n",
+        "            qts.append(df['query_time'].std())\n",
+        "\n",
+        "    # Promedios por familia\n",
+        "    if acc:  # solo si hubo archivos válidos\n",
+        "        print(f'{family.split(\".\")[0]:15}: '\n",
+        "              f'acc:{np.mean(acc):.2f}±{np.std(acc):.3f} '\n",
+        "              f'f1:{np.mean(f1):.2f}±{np.std(f1):.3f} '\n",
+        "              f'pre:{np.mean(pre):.2f}±{np.std(pre):.3f} '\n",
+        "              f'rec:{np.mean(rec):.2f}±{np.std(rec):.3f} '\n",
+        "              f'FPR:{np.mean(fpr):.2f}±{np.std(fpr):.3f} '\n",
+        "              f'TPR:{np.mean(tpr):.2f}±{np.std(tpr):.3f} '\n",
+        "              f'QT:{np.mean(qt):.5f}±{np.std(qt):.5f} '\n",
+        "              f'Unknowns: {total_unknowns}')\n",
+        "\n",
+        "        all_acc.append(np.mean(acc))\n",
+        "        all_pre.append(np.mean(pre))\n",
+        "        all_rec.append(np.mean(rec))\n",
+        "        all_f1.append(np.mean(f1))\n",
+        "        all_fpr.append(np.mean(fpr))\n",
+        "        all_tpr.append(np.mean(tpr))\n",
+        "        all_qt.append(np.mean(qt))\n",
+        "        all_qts.append(np.mean(qts))\n",
+        "        total_unknowns_global += total_unknowns\n",
+        "\n",
+        "# 🔍 Métricas globales\n",
+        "print(\"\\n### 📊 Métricas globales ###\")\n",
+        "print(f'Accuracy   : {np.mean(all_acc):.2f}')\n",
+        "print(f'F1-Score   : {np.mean(all_f1):.2f}')\n",
+        "print(f'Precision  : {np.mean(all_pre):.2f}')\n",
+        "print(f'Recall     : {np.mean(all_rec):.2f}')\n",
+        "print(f'FPR        : {np.mean(all_fpr):.2f}')\n",
+        "print(f'TPR        : {np.mean(all_tpr):.2f}')\n",
+        "print(f'Query time : {np.mean(all_qt):.5f} ± {np.mean(all_qts):.5f}')\n",
+        "print(f'Total unknown classifications: {total_unknowns_global}')\n"
+      ],
+      "metadata": {
+        "colab": {
+          "base_uri": "https://localhost:8080/"
+        },
+        "id": "Ta40upzq_H5c",
+        "outputId": "eb0dfd23-7ab8-41cb-da46-21d00a721b18"
+      },
+      "execution_count": 8,
+      "outputs": [
+        {
+          "output_type": "stream",
+          "name": "stdout",
+          "text": [
+            "matsnu         : acc:0.90±0.029 f1:0.90±0.026 pre:0.86±0.042 rec:0.95±0.033 FPR:0.15±0.055 TPR:0.95±0.033 QT:0.00043±0.00006 Unknowns: 0\n",
+            "suppobox       : acc:0.92±0.027 f1:0.93±0.024 pre:0.87±0.041 rec:1.00±0.004 FPR:0.15±0.055 TPR:1.00±0.004 QT:0.00043±0.00004 Unknowns: 0\n",
+            "charbot        : acc:0.80±0.037 f1:0.79±0.039 pre:0.83±0.051 rec:0.76±0.051 FPR:0.15±0.055 TPR:0.76±0.051 QT:0.00043±0.00003 Unknowns: 0\n",
+            "gozi           : acc:0.81±0.060 f1:0.80±0.071 pre:0.83±0.055 rec:0.77±0.110 FPR:0.15±0.055 TPR:0.77±0.110 QT:0.00052±0.00008 Unknowns: 0\n",
+            "manuelita      : acc:0.50±0.038 f1:0.23±0.060 pre:0.50±0.134 rec:0.15±0.041 FPR:0.15±0.055 TPR:0.15±0.041 QT:0.00049±0.00011 Unknowns: 0\n",
+            "rovnix         : acc:0.92±0.030 f1:0.92±0.026 pre:0.87±0.042 rec:0.99±0.014 FPR:0.15±0.055 TPR:0.99±0.014 QT:0.00044±0.00006 Unknowns: 0\n",
+            "deception      : acc:0.92±0.028 f1:0.92±0.024 pre:0.87±0.042 rec:0.99±0.012 FPR:0.15±0.055 TPR:0.99±0.012 QT:0.00042±0.00003 Unknowns: 0\n",
+            "nymaim         : acc:0.82±0.043 f1:0.82±0.046 pre:0.84±0.051 rec:0.80±0.060 FPR:0.15±0.055 TPR:0.80±0.060 QT:0.00043±0.00005 Unknowns: 0\n",
+            "bigviktor      : acc:0.60±0.041 f1:0.47±0.061 pre:0.70±0.086 rec:0.36±0.057 FPR:0.16±0.054 TPR:0.36±0.057 QT:0.00043±0.00005 Unknowns: 0\n",
+            "pizd           : acc:0.91±0.028 f1:0.91±0.025 pre:0.86±0.041 rec:0.97±0.019 FPR:0.16±0.054 TPR:0.97±0.019 QT:0.00049±0.00009 Unknowns: 0\n",
+            "ngioweb        : acc:0.66±0.052 f1:0.58±0.072 pre:0.75±0.080 rec:0.47±0.071 FPR:0.16±0.054 TPR:0.47±0.071 QT:0.00059±0.00012 Unknowns: 0\n",
+            "\n",
+            "### 📊 Métricas globales ###\n",
+            "Accuracy   : 0.80\n",
+            "F1-Score   : 0.75\n",
+            "Precision  : 0.80\n",
+            "Recall     : 0.75\n",
+            "FPR        : 0.15\n",
+            "TPR        : 0.75\n",
+            "Query time : 0.00046 ± 0.00012\n",
+            "Total unknown classifications: 0\n"
+          ]
+        }
+      ]
+    }
+  ]
+}