forensics-ml-cpp/plot.py at main · PoorProgrammer0A33/forensics-ml-cpp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
import pandas as pd
import matplotlib.pyplot as plt
import numpy as np

df = pd.read_csv("csv/output.csv")

anomaly_scores = [
    1.6132, 1.6507, 1.7966, 1.6545, 1.7236, 0.7443,
    3.4991, 2.6177, 1.5278, 1.8318, 1.8170, 0.9241,
    1.0500, 0.8219, 2.2012, 1.3124, 1.3218, 1.7477,
    0.8659, 0.9712, 1.1445, 1.0038, 2.2890, 1.9610,
    1.3757, 0.8064, 1.4976, 2.9929, 1.1846, 1.3610
]

df["anomaly_score"] = anomaly_scores
threshold = 1.0

fig, axes = plt.subplots(1, 3, figsize=(18, 5))
fig.suptitle("Forensics File Analysis — C++ Pipeline Output",
             fontsize=14, fontweight="bold")


scatter = axes[0].scatter(
    df["file_size_kb"],
    df["access_counts"],
    c=df["anomaly_score"],
    cmap="RdYlGn_r",
    s=100,
    edgecolors="black",
    vmin=0, vmax=4
)
plt.colorbar(scatter, ax=axes[0], label="Anomaly Score")
axes[0].axhline(y=threshold, color="gray", linestyle="--", alpha=0.3)
axes[0].set_title("File Size vs Access Count\n(color = anomaly score)")
axes[0].set_xlabel("File Size (KB)")
axes[0].set_ylabel("Access Count")


bar_colors = ["red" if s > threshold else "steelblue"
              for s in anomaly_scores]
axes[1].bar(range(len(df)), df["anomaly_score"],
            color=bar_colors, edgecolor="black", alpha=0.8)
axes[1].axhline(y=threshold, color="red", linestyle="--",
                linewidth=2, label=f"Threshold ({threshold})")
axes[1].set_title("Anomaly Score per File")
axes[1].set_xlabel("File Index")
axes[1].set_ylabel("Mahalanobis Distance")
axes[1].legend()


axes[2].hist(df["anomaly_score"], bins=10, color="steelblue",
             edgecolor="black", alpha=0.8)
axes[2].axvline(x=threshold, color="red", linestyle="--",
                linewidth=2, label=f"Threshold ({threshold})")
axes[2].set_title("Distribution of Anomaly Scores")
axes[2].set_xlabel("Mahalanobis Distance")
axes[2].set_ylabel("Number of Files")
axes[2].legend()

plt.tight_layout()
plt.savefig("csv/forensics_anomaly_plot.png", dpi=150)
plt.show()
print("Plot saved to csv/forensics_anomaly_plot.png")