{
 "nbformat": 4,
 "nbformat_minor": 5,
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "name": "python",
   "version": "3.x"
  },
  "colab": {
   "provenance": []
  }
 },
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Lab 2 - Exploring Security Data 📧\n",
    "### CIS 350: AI for Cybersecurity - Smart Defense for the Digital Business\n",
    "\n",
    "**Worth:** 50 points  ·  **Time:** ~45-60 minutes  ·  **Submit:** this `.ipynb` file in Canvas\n",
    "\n",
    "In Lab 1 you ran your first Python. Now you'll act like a security analyst: open a **phishing-email dataset**, count phishing vs. legitimate mail, compare their features, and chart what you find. This is exactly the **rows / features / label** idea from Wednesday's lecture.\n",
    "\n",
    "**What you'll do**\n",
    "1. Load a phishing-email dataset with pandas.\n",
    "2. Count phishing (spam) vs. legitimate (ham) messages.\n",
    "3. Compare features (links, urgent words) between spam and ham.\n",
    "4. Make two charts and interpret them.\n",
    "5. Answer guided questions connecting back to features, labels, and data quality.\n",
    "\n",
    "Run cells in order with **Shift + Enter**. Fill every **`TODO`** blank (`____`).\n",
    "\n",
    "> **Academic integrity:** individual or pair work. **AI tools are not permitted** on labs - the code and answers must be your own."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 1 · Load the phishing-email dataset\n",
    "Each **row** is one email. The columns `num_links`, `has_attachment`, `sender_mismatch`, and `urgent_words` are **features**. The column `label` (spam / ham) is the **answer** we'd want a model to predict."
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "import pandas as pd\n",
    "\n",
    "# A small (fictional) phishing-email dataset. Each row is one email.\n",
    "data = {\n",
    "    \"num_links\":       [5, 8, 6, 4, 9, 7, 5, 6,  1, 0, 2, 1, 0, 1, 2, 0, 1, 1, 0, 2, 1, 0, 1, 2],\n",
    "    \"has_attachment\":  [1, 1, 1, 0, 1, 1, 1, 1,  0, 0, 0, 1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0],\n",
    "    \"sender_mismatch\": [1, 1, 1, 1, 1, 0, 1, 1,  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],\n",
    "    \"urgent_words\":    [3, 5, 2, 4, 3, 2, 4, 3,  0, 1, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 0],\n",
    "    \"label\": [\"spam\"] * 8 + [\"ham\"] * 16,\n",
    "}\n",
    "\n",
    "df = pd.DataFrame(data)\n",
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "# TODO 1: print how many emails (rows) are in the dataset.\n",
    "# Hint: len(df)\n",
    "print(\"Total emails:\", ____)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 2 · Count phishing vs. legitimate\n",
    "`value_counts()` counts how many times each label appears."
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "# TODO 2: count spam vs. ham.\n",
    "# Hint: df[\"label\"].value_counts()\n",
    "counts = ____\n",
    "print(counts)\n",
    "\n",
    "# TODO 3: what percent of emails are spam? (0-100)\n",
    "# Hint: counts[\"spam\"] / len(df) * 100\n",
    "percent_spam = ____\n",
    "print(\"Percent spam: {:.1f}%\".format(percent_spam))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 3 · Compare features between spam and ham\n",
    "`groupby` lets us average a feature separately for each label."
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "# TODO 4: average number of links for spam vs. ham.\n",
    "# Hint: df.groupby(\"label\")[\"num_links\"].mean()\n",
    "avg_links = ____\n",
    "print(\"Average links by label:\")\n",
    "print(avg_links)\n",
    "\n",
    "# (Provided) average urgent words by label - run and compare:\n",
    "print()\n",
    "print(\"Average urgent words by label:\")\n",
    "print(df.groupby(\"label\")[\"urgent_words\"].mean())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 4 · Picture it - two charts"
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "import matplotlib.pyplot as plt\n",
    "\n",
    "# Chart 1: how many spam vs. ham?\n",
    "counts = df[\"label\"].value_counts()\n",
    "plt.figure(figsize=(5, 4))\n",
    "counts.plot(kind=\"bar\", color=[\"#1E4D2B\", \"#C8C372\"])\n",
    "# TODO 5: give this chart a clear title (put text in the quotes).\n",
    "plt.title(\"\")\n",
    "plt.ylabel(\"Number of emails\")\n",
    "plt.tight_layout(); plt.show()"
   ]
  },
  {
   "cell_type": "code",
   "metadata": {},
   "execution_count": null,
   "outputs": [],
   "source": [
    "# Chart 2: average links per email, spam vs. ham (mostly provided).\n",
    "avg_links = df.groupby(\"label\")[\"num_links\"].mean()\n",
    "plt.figure(figsize=(5, 4))\n",
    "avg_links.plot(kind=\"bar\", color=[\"#1E4D2B\", \"#C8C372\"])\n",
    "plt.title(\"Average links per email, by type\")\n",
    "plt.ylabel(\"Average number of links\")\n",
    "plt.tight_layout(); plt.show()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 5 · What does it mean? (Guided questions)\n",
    "Double-click the cell below and replace each *your answer here*."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Your answers** - replace the italics.\n",
    "\n",
    "1. **How many emails total, how many spam vs. ham, and what percent are spam?** *your answer here*\n",
    "2. **Which features differ most between spam and ham? Give the numbers.** *your answer here*\n",
    "3. **If you could use only ONE feature to flag spam, which would you pick and why?** *your answer here*\n",
    "4. **There is more ham than spam. Why does that imbalance matter when judging a model?** (recall Wednesday) *your answer here*\n",
    "5. **In dataset terms, what are the FEATURES here, and what is the LABEL?** *your answer here*"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## ✅ Before you submit\n",
    "\n",
    "- [ ] **Runtime -> Run all** completes with no errors.\n",
    "- [ ] All `TODO` blanks (`____`) are filled in.\n",
    "- [ ] Both charts display, each with a title.\n",
    "- [ ] You answered all 5 guided questions.\n",
    "- [ ] **File -> Download -> Download .ipynb**, then upload to Canvas.\n",
    "\n",
    "Working as a pair? Put **both names** in a cell at the top and make sure both of you understand every step."
   ]
  }
 ]
}