diff --git a/webthreatinteractions.ipynb b/webthreatinteractions.ipynb
new file mode 100644
index 0000000..d30c714
--- /dev/null
+++ b/webthreatinteractions.ipynb
@@ -0,0 +1,735 @@
+{
+ "nbformat": 4,
+ "nbformat_minor": 0,
+ "metadata": {
+ "colab": {
+ "provenance": [],
+ "authorship_tag": "ABX9TyN/5DE0I7yyo9r0OIj5Cayi",
+ "include_colab_link": true
+ },
+ "kernelspec": {
+ "name": "python3",
+ "display_name": "Python 3"
+ },
+ "language_info": {
+ "name": "python"
+ }
+ },
+ "cells": [
+ {
+ "cell_type": "markdown",
+ "metadata": {
+ "id": "view-in-github",
+ "colab_type": "text"
+ },
+ "source": [
+ ""
+ ]
+ },
+ {
+ "cell_type": "code",
+ "execution_count": null,
+ "metadata": {
+ "id": "b-yq8cEWHYRP"
+ },
+ "outputs": [],
+ "source": [
+ "# Import necessary libraries\n",
+ "import warnings\n",
+ "warnings.filterwarnings(\"ignore\")\n",
+ "\n",
+ "import pandas as pd\n",
+ "import numpy as np\n",
+ "import seaborn as sns\n",
+ "import networkx as nx\n",
+ "import matplotlib.pyplot as plt\n",
+ "\n",
+ "from sklearn.preprocessing import StandardScaler, OneHotEncoder\n",
+ "from sklearn.model_selection import train_test_split\n",
+ "from sklearn.metrics import accuracy_score\n",
+ "import tensorflow as tf\n",
+ "from tensorflow.keras.models import Sequential\n",
+ "from tensorflow.keras.layers import Dense, Dropout\n",
+ "from tensorflow.keras.optimizers import Adam"
+ ]
+ },
+ {
+ "cell_type": "code",
+ "source": [
+ "# Load the data into a DataFrame\n",
+ "data = pd.read_csv(\"/CloudWatch_Traffic_Web_Attack.csv\")\n",
+ "\n",
+ "# Display the first few rows of the DataFrame to understand its structure\n",
+ "print(data.head())"
+ ],
+ "metadata": {
+ "colab": {
+ "base_uri": "https://localhost:8080/"
+ },
+ "id": "tYAK68QgHJDn",
+ "outputId": "b4649ca3-4c8f-4b2a-d27c-a821b78d9e95"
+ },
+ "execution_count": null,
+ "outputs": [
+ {
+ "output_type": "stream",
+ "name": "stdout",
+ "text": [
+ " bytes_in bytes_out creation_time end_time \\\n",
+ "0 5602 12990 2024-04-25T23:00:00Z 2024-04-25T23:10:00Z \n",
+ "1 30912 18186 2024-04-25T23:00:00Z 2024-04-25T23:10:00Z \n",
+ "2 28506 13468 2024-04-25T23:00:00Z 2024-04-25T23:10:00Z \n",
+ "3 30546 14278 2024-04-25T23:00:00Z 2024-04-25T23:10:00Z \n",
+ "4 6526 13892 2024-04-25T23:00:00Z 2024-04-25T23:10:00Z \n",
+ "\n",
+ " src_ip src_ip_country_code protocol response.code dst_port \\\n",
+ "0 147.161.161.82 AE HTTPS 200 443 \n",
+ "1 165.225.33.6 US HTTPS 200 443 \n",
+ "2 165.225.212.255 CA HTTPS 200 443 \n",
+ "3 136.226.64.114 US HTTPS 200 443 \n",
+ "4 165.225.240.79 NL HTTPS 200 443 \n",
+ "\n",
+ " dst_ip rule_names observation_name \\\n",
+ "0 10.138.69.97 Suspicious Web Traffic Adversary Infrastructure Interaction \n",
+ "1 10.138.69.97 Suspicious Web Traffic Adversary Infrastructure Interaction \n",
+ "2 10.138.69.97 Suspicious Web Traffic Adversary Infrastructure Interaction \n",
+ "3 10.138.69.97 Suspicious Web Traffic Adversary Infrastructure Interaction \n",
+ "4 10.138.69.97 Suspicious Web Traffic Adversary Infrastructure Interaction \n",
+ "\n",
+ " source.meta source.name time detection_types \n",
+ "0 AWS_VPC_Flow prod_webserver 2024-04-25T23:00:00Z waf_rule \n",
+ "1 AWS_VPC_Flow prod_webserver 2024-04-25T23:00:00Z waf_rule \n",
+ "2 AWS_VPC_Flow prod_webserver 2024-04-25T23:00:00Z waf_rule \n",
+ "3 AWS_VPC_Flow prod_webserver 2024-04-25T23:00:00Z waf_rule \n",
+ "4 AWS_VPC_Flow prod_webserver 2024-04-25T23:00:00Z waf_rule \n"
+ ]
+ }
+ ]
+ },
+ {
+ "cell_type": "code",
+ "source": [
+ "# Convert 'creation_time' to datetime format\n",
+ "data['creation_time'] = pd.to_datetime(data['creation_time'])\n",
+ "\n",
+ "# Set 'creation_time' as the index\n",
+ "data.set_index('creation_time', inplace=True)\n"
+ ],
+ "metadata": {
+ "id": "SS7AzLSrH_Aa"
+ },
+ "execution_count": null,
+ "outputs": []
+ },
+ {
+ "cell_type": "code",
+ "source": [
+ "# Check if 'creation_time' is still a column\n",
+ "if 'creation_time' in data.columns:\n",
+ " # Convert 'creation_time' to datetime format if it's still a column\n",
+ " data['creation_time'] = pd.to_datetime(data['creation_time'])\n",
+ "\n",
+ " # Set 'creation_time' as the index\n",
+ " data.set_index('creation_time', inplace=True)\n",
+ "else:\n",
+ " print(\"`creation_time` is already the index.\")"
+ ],
+ "metadata": {
+ "id": "dPn_MdU4IIVn",
+ "colab": {
+ "base_uri": "https://localhost:8080/"
+ },
+ "outputId": "cae9e279-ad3a-4d1c-eebd-e87db5fbd5d2"
+ },
+ "execution_count": null,
+ "outputs": [
+ {
+ "output_type": "stream",
+ "name": "stdout",
+ "text": [
+ "`creation_time` is already the index.\n"
+ ]
+ }
+ ]
+ },
+ {
+ "cell_type": "code",
+ "source": [
+ "# Plotting web traffic over time\n",
+ "plt.figure(figsize=(12, 6))\n",
+ "plt.plot(data.index, data['bytes_in'], label='Bytes In', marker='o')\n",
+ "plt.plot(data.index, data['bytes_out'], label='Bytes Out', marker='o')\n",
+ "plt.title('Web Traffic Analysis Over Time')\n",
+ "plt.xlabel('Time')\n",
+ "plt.ylabel('Bytes')\n",
+ "plt.legend()\n",
+ "plt.grid(True)\n",
+ "plt.xticks(rotation=45)\n",
+ "plt.tight_layout()\n",
+ "plt.show()\n"
+ ],
+ "metadata": {
+ "id": "be19k_ijIbZK",
+ "colab": {
+ "base_uri": "https://localhost:8080/",
+ "height": 607
+ },
+ "outputId": "14da43d0-4a7e-4541-ade3-45301bdd6f4d"
+ },
+ "execution_count": null,
+ "outputs": [
+ {
+ "output_type": "display_data",
+ "data": {
+ "text/plain": [
+ "