LSTM_Original_Imbalanced_Dataset.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Long-Short Term Memory (LSTM) Network\n",
    "\n",
    "This code is part our research on malware detection and classification using Deep Learning and Deep Graph Convolutional Neural Networks.\n",
    "\n",
    "For more information or citation, please refer to our research paper:\n",
    "\n",
    "\"Oliveira, Angelo; Sassi, Renato José (2019): Behavioral Malware Detection Using Deep Graph Convolutional Neural Networks. TechRxiv. Preprint.\" at https://doi.org/10.36227/techrxiv.10043099.v1\n",
    "\n",
    "For the dataset, please refer to our repository:\n",
    "\n",
    "https://ieee-dataport.org/open-access/malware-analysis-datasets-api-call-sequences\n",
    "\n",
    "#### Original (imbalanced) Dataset"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "import numpy as np\n",
    "SEED = 137\n",
    "np.random.seed(SEED)\n",
    "\n",
    "import time\n",
    "from collections import Counter\n",
    "\n",
    "import pandas as pd\n",
    "\n",
    "from sklearn.model_selection import train_test_split, GridSearchCV, StratifiedKFold\n",
    "from sklearn.metrics import accuracy_score, recall_score, confusion_matrix\n",
    "from sklearn.metrics import precision_score, f1_score, roc_auc_score\n",
    "\n",
    "from imblearn.pipeline import Pipeline\n",
    "\n",
    "import torch\n",
    "torch.manual_seed(SEED)\n",
    "import torch.nn as nn\n",
    "import torch.nn.functional as F\n",
    "\n",
    "from skorch.classifier import NeuralNetBinaryClassifier"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Data Preprocessing"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>hash</th>\n",
       "      <th>t_0</th>\n",
       "      <th>t_1</th>\n",
       "      <th>t_2</th>\n",
       "      <th>t_3</th>\n",
       "      <th>t_4</th>\n",
       "      <th>t_5</th>\n",
       "      <th>t_6</th>\n",
       "      <th>t_7</th>\n",
       "      <th>t_8</th>\n",
       "      <th>...</th>\n",
       "      <th>t_91</th>\n",
       "      <th>t_92</th>\n",
       "      <th>t_93</th>\n",
       "      <th>t_94</th>\n",
       "      <th>t_95</th>\n",
       "      <th>t_96</th>\n",
       "      <th>t_97</th>\n",
       "      <th>t_98</th>\n",
       "      <th>t_99</th>\n",
       "      <th>malware</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <td>0</td>\n",
       "      <td>071e8c3f8922e186e57548cd4c703a5d</td>\n",
       "      <td>112</td>\n",
       "      <td>274</td>\n",
       "      <td>158</td>\n",
       "      <td>215</td>\n",
       "      <td>274</td>\n",
       "      <td>158</td>\n",
       "      <td>215</td>\n",
       "      <td>298</td>\n",
       "      <td>76</td>\n",
       "      <td>...</td>\n",
       "      <td>71</td>\n",
       "      <td>297</td>\n",
       "      <td>135</td>\n",
       "      <td>171</td>\n",
       "      <td>215</td>\n",
       "      <td>35</td>\n",
       "      <td>208</td>\n",
       "      <td>56</td>\n",
       "      <td>71</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>1</td>\n",
       "      <td>33f8e6d08a6aae939f25a8e0d63dd523</td>\n",
       "      <td>82</td>\n",
       "      <td>208</td>\n",
       "      <td>187</td>\n",
       "      <td>208</td>\n",
       "      <td>172</td>\n",
       "      <td>117</td>\n",
       "      <td>172</td>\n",
       "      <td>117</td>\n",
       "      <td>172</td>\n",
       "      <td>...</td>\n",
       "      <td>81</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>71</td>\n",
       "      <td>297</td>\n",
       "      <td>135</td>\n",
       "      <td>171</td>\n",
       "      <td>215</td>\n",
       "      <td>35</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>2</td>\n",
       "      <td>b68abd064e975e1c6d5f25e748663076</td>\n",
       "      <td>16</td>\n",
       "      <td>110</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>...</td>\n",
       "      <td>65</td>\n",
       "      <td>112</td>\n",
       "      <td>123</td>\n",
       "      <td>65</td>\n",
       "      <td>112</td>\n",
       "      <td>123</td>\n",
       "      <td>65</td>\n",
       "      <td>113</td>\n",
       "      <td>112</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>3</td>\n",
       "      <td>72049be7bd30ea61297ea624ae198067</td>\n",
       "      <td>82</td>\n",
       "      <td>208</td>\n",
       "      <td>187</td>\n",
       "      <td>208</td>\n",
       "      <td>172</td>\n",
       "      <td>117</td>\n",
       "      <td>172</td>\n",
       "      <td>117</td>\n",
       "      <td>172</td>\n",
       "      <td>...</td>\n",
       "      <td>208</td>\n",
       "      <td>302</td>\n",
       "      <td>208</td>\n",
       "      <td>302</td>\n",
       "      <td>187</td>\n",
       "      <td>208</td>\n",
       "      <td>302</td>\n",
       "      <td>228</td>\n",
       "      <td>302</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <td>4</td>\n",
       "      <td>c9b3700a77facf29172f32df6bc77f48</td>\n",
       "      <td>82</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>240</td>\n",
       "      <td>117</td>\n",
       "      <td>...</td>\n",
       "      <td>209</td>\n",
       "      <td>260</td>\n",
       "      <td>40</td>\n",
       "      <td>209</td>\n",
       "      <td>260</td>\n",
       "      <td>141</td>\n",
       "      <td>260</td>\n",
       "      <td>141</td>\n",
       "      <td>260</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>5 rows × 102 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                               hash  t_0  t_1  t_2  t_3  t_4  t_5  t_6  t_7  \\\n",
       "0  071e8c3f8922e186e57548cd4c703a5d  112  274  158  215  274  158  215  298   \n",
       "1  33f8e6d08a6aae939f25a8e0d63dd523   82  208  187  208  172  117  172  117   \n",
       "2  b68abd064e975e1c6d5f25e748663076   16  110  240  117  240  117  240  117   \n",
       "3  72049be7bd30ea61297ea624ae198067   82  208  187  208  172  117  172  117   \n",
       "4  c9b3700a77facf29172f32df6bc77f48   82  240  117  240  117  240  117  240   \n",
       "\n",
       "   t_8  ...  t_91  t_92  t_93  t_94  t_95  t_96  t_97  t_98  t_99  malware  \n",
       "0   76  ...    71   297   135   171   215    35   208    56    71        1  \n",
       "1  172  ...    81   240   117    71   297   135   171   215    35        1  \n",
       "2  240  ...    65   112   123    65   112   123    65   113   112        1  \n",
       "3  172  ...   208   302   208   302   187   208   302   228   302        1  \n",
       "4  117  ...   209   260    40   209   260   141   260   141   260        1  \n",
       "\n",
       "[5 rows x 102 columns]"
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "df = pd.read_csv('dynamic_api_call_sequence_per_malware_100_0_306.csv')\n",
    "df.head()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "<class 'pandas.core.frame.DataFrame'>\n",
      "RangeIndex: 43876 entries, 0 to 43875\n",
      "Columns: 102 entries, hash to malware\n",
      "dtypes: int64(101), object(1)\n",
      "memory usage: 34.1+ MB\n"
     ]
    }
   ],
   "source": [
    "df.info()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "(43876, 100)\n",
      "(43876,)\n"
     ]
    }
   ],
   "source": [
    "X = df.drop(['hash', 'malware'], axis = 1).values.astype(int)\n",
    "y = df['malware'].values.astype(int)\n",
    "print(X.shape)\n",
    "print(y.shape)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0\n",
      "306\n"
     ]
    }
   ],
   "source": [
    "print(X.min())\n",
    "print(X.max())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [],
   "source": [
    "def check_imbalance(dataset):\n",
    "    count = sorted(Counter(dataset).items())\n",
    "    print(count)\n",
    "    print(count[1][1] / count[0][1])\n",
    "    return"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[(0, 1079), (1, 42797)]\n",
      "39.66357738646895\n"
     ]
    }
   ],
   "source": [
    "check_imbalance(y)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "X_train, X_test, y_train, y_test = train_test_split(X, y, test_size = 0.3, random_state = SEED)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[(0, 731), (1, 29982)]\n",
      "41.015047879616965\n",
      "[(0, 348), (1, 12815)]\n",
      "36.82471264367816\n"
     ]
    }
   ],
   "source": [
    "check_imbalance(y_train)\n",
    "check_imbalance(y_test)\n",
    "\n",
    "del df, X, y"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Architecture"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "LSTM_network(\n",
      "  (lstm): LSTM(307, 70, batch_first=True)\n",
      "  (dropout): Dropout(p=0.4, inplace=False)\n",
      "  (fc): Linear(in_features=70, out_features=1, bias=True)\n",
      ")\n",
      "\n",
      "Parameters: 106191\n"
     ]
    }
   ],
   "source": [
    "class LSTM_network(nn.Module):\n",
    "    \n",
    "    def __init__(self, input_dim, hidden_dim, dropout_rate):\n",
    "        \n",
    "        super(LSTM_network, self).__init__()\n",
    "        \n",
    "        self.input_dim = input_dim\n",
    "        self.hidden_dim = hidden_dim\n",
    "        self.dropout_rate = dropout_rate\n",
    "        \n",
    "        self.lstm = nn.LSTM(self.input_dim, self.hidden_dim, batch_first = True)\n",
    "        self.dropout = nn.Dropout(p = self.dropout_rate)\n",
    "        self.fc = nn.Linear(self.hidden_dim, 1)\n",
    "        \n",
    "    def forward(self, X):\n",
    "        \n",
    "        X = F.one_hot(X, num_classes = self.input_dim).float().cuda()\n",
    "        \n",
    "        # Hidden layer shape: (num_layers, batch_size, hidden_dim)\n",
    "        hidden_0 = (torch.zeros(1, X.size(0), self.hidden_dim).float().cuda(),\n",
    "                    torch.zeros(1, X.size(0), self.hidden_dim).float().cuda())\n",
    "        \n",
    "        # Input/Output shape: (batch_size, seq_len, input_dim)\n",
    "        _, self.hidden = self.lstm(X, hidden_0)\n",
    "                \n",
    "        H = self.hidden[0].squeeze()\n",
    "        H = self.dropout(H)\n",
    "        H = self.fc(H)\n",
    "                \n",
    "        return H.squeeze()\n",
    "\n",
    "model = LSTM_network(\n",
    "    input_dim = 307,\n",
    "    hidden_dim = 70,\n",
    "    dropout_rate = 0.4\n",
    ")\n",
    "\n",
    "print(model)\n",
    "print(f'\\nParameters: {np.sum([param.numel() for param in model.parameters()])}')\n",
    "del model"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Hyperparameter Optimization"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "start_training = time.time()\n",
    "\n",
    "torch.manual_seed(SEED)\n",
    "\n",
    "input_dim = 307\n",
    "\n",
    "net = NeuralNetBinaryClassifier(\n",
    "    LSTM_network,\n",
    "    module__input_dim = input_dim,\n",
    "    module__hidden_dim = 10,\n",
    "    module__dropout_rate = 0.4,\n",
    "    batch_size = 32,\n",
    "    max_epochs = 10,\n",
    "    train_split = None,\n",
    "    optimizer = torch.optim.Adam,\n",
    "    iterator_train__shuffle = True,\n",
    "    device = 'cuda'\n",
    ")\n",
    "\n",
    "pipe = Pipeline([\n",
    "    ('net', net)\n",
    "])\n",
    "\n",
    "params = {\n",
    "    'net__module__hidden_dim' : [10, 40, 70, 100],\n",
    "    'net__module__dropout_rate' : [0.4, 0.5, 0.6],\n",
    "    'net__batch_size' : [32, 64, 128],\n",
    "    'net__max_epochs' : [10, 20, 30]\n",
    "}\n",
    "\n",
    "gs = GridSearchCV(\n",
    "    pipe,\n",
    "    params,\n",
    "    refit = False,\n",
    "    cv = StratifiedKFold(n_splits = 5, random_state = SEED, shuffle = True),\n",
    "    scoring = lambda net_gs, X_gs, y_gs : roc_auc_score(y_gs, net_gs.predict_proba(X_gs)),\n",
    "    verbose = 2\n",
    ")\n",
    "\n",
    "gs.fit(X_train, y_train.astype(np.float))\n",
    "\n",
    "print(gs.best_score_, gs.best_params_)\n",
    "\n",
    "end_training = (time.time() - start_training) / 60\n",
    "\n",
    "print(f'\\nDone! Time: {end_training:.2f} min')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Best Configuration:\n",
    "\n",
    "0.9785214228116321 {'net__batch_size': 128, 'net__max_epochs': 30, 'net__module__dropout_rate': 0.5, 'net__module__hidden_dim': 70}"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Training"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "  epoch    train_loss     dur\n",
      "-------  ------------  ------\n",
      "      1        \u001b[36m0.1165\u001b[0m  2.0653\n",
      "      2        \u001b[36m0.0820\u001b[0m  1.8067\n",
      "      3        0.0831  1.7954\n",
      "      4        \u001b[36m0.0773\u001b[0m  1.7638\n",
      "      5        \u001b[36m0.0694\u001b[0m  1.8249\n",
      "      6        \u001b[36m0.0595\u001b[0m  1.7852\n",
      "      7        \u001b[36m0.0489\u001b[0m  1.7634\n",
      "      8        \u001b[36m0.0407\u001b[0m  1.7743\n",
      "      9        \u001b[36m0.0344\u001b[0m  1.7586\n",
      "     10        \u001b[36m0.0305\u001b[0m  1.7412\n",
      "     11        \u001b[36m0.0303\u001b[0m  1.7423\n",
      "     12        \u001b[36m0.0290\u001b[0m  1.7601\n",
      "     13        \u001b[36m0.0247\u001b[0m  1.7469\n",
      "     14        \u001b[36m0.0219\u001b[0m  1.7429\n",
      "     15        0.0251  1.7417\n",
      "     16        \u001b[36m0.0203\u001b[0m  1.7526\n",
      "     17        \u001b[36m0.0191\u001b[0m  1.7579\n",
      "     18        0.0202  1.8259\n",
      "     19        \u001b[36m0.0145\u001b[0m  1.8207\n",
      "     20        0.0170  1.7585\n",
      "     21        0.0154  1.8242\n",
      "     22        0.0160  1.7493\n",
      "     23        \u001b[36m0.0137\u001b[0m  1.8546\n",
      "     24        \u001b[36m0.0117\u001b[0m  1.7969\n",
      "     25        0.0123  1.8098\n",
      "     26        \u001b[36m0.0102\u001b[0m  1.8351\n",
      "     27        0.0105  1.8276\n",
      "     28        \u001b[36m0.0091\u001b[0m  1.8432\n",
      "     29        0.0130  1.7619\n",
      "     30        \u001b[36m0.0081\u001b[0m  1.7664\n"
     ]
    },
    {
     "data": {
      "text/plain": [
       "Pipeline(memory=None,\n",
       "         steps=[('net',\n",
       "                 <class 'skorch.classifier.NeuralNetBinaryClassifier'>[initialized](\n",
       "  module_=LSTM_network(\n",
       "    (lstm): LSTM(307, 70, batch_first=True)\n",
       "    (dropout): Dropout(p=0.5, inplace=False)\n",
       "    (fc): Linear(in_features=70, out_features=1, bias=True)\n",
       "  ),\n",
       "))],\n",
       "         verbose=False)"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "torch.manual_seed(SEED)\n",
    "\n",
    "# hidden_dim = gs.best_params_['net__module__hidden_dim']\n",
    "# dropout_rate = gs.best_params_['net__module__dropout_rate']\n",
    "# batch_size = gs.best_params_['net__batch_size']\n",
    "# max_epochs = gs.best_params_['net__max_epochs']\n",
    "\n",
    "input_dim = 307\n",
    "hidden_dim = 70\n",
    "dropout_rate = 0.5\n",
    "batch_size = 128\n",
    "max_epochs = 30\n",
    "\n",
    "net = NeuralNetBinaryClassifier(\n",
    "    LSTM_network,\n",
    "    module__input_dim = input_dim,\n",
    "    module__hidden_dim = hidden_dim,\n",
    "    module__dropout_rate = dropout_rate,\n",
    "    batch_size = batch_size,\n",
    "    max_epochs = max_epochs,\n",
    "    train_split = None,\n",
    "    optimizer = torch.optim.Adam,\n",
    "    iterator_train__shuffle = True,\n",
    "    device = 'cuda'\n",
    ")\n",
    "\n",
    "pipe = Pipeline([\n",
    "    ('net', net)\n",
    "])\n",
    "\n",
    "pipe.fit(X_train, y_train.astype(np.float))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Evaluation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [],
   "source": [
    "def model_evaluate(y, pred):\n",
    "    print('Confusion matrix\\n[TN FP]\\n[FN TP]')\n",
    "    print(confusion_matrix(y >= 0.5, pred >= 0.5))\n",
    "    print(f'Accuracy: {accuracy_score(y >= 0.5, pred >= 0.5):.4f}')\n",
    "    print(f'Precision: {precision_score(y >= 0.5, pred >= 0.5):.4f}')\n",
    "    print(f'Recall: {recall_score(y >= 0.5, pred >= 0.5):.4f}')\n",
    "    print(f'F1-Score: {f1_score(y >= 0.5, pred >= 0.5):.4f}')\n",
    "    print(f'ROC AUC: {roc_auc_score(y, pred):.4f}')\n",
    "    return"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Confusion matrix\n",
      "[TN FP]\n",
      "[FN TP]\n",
      "[[    0   348]\n",
      " [    0 12815]]\n",
      "Accuracy: 0.9736\n",
      "Precision: 0.9736\n",
      "Recall: 1.0000\n",
      "F1-Score: 0.9866\n",
      "ROC AUC: 0.5000\n"
     ]
    }
   ],
   "source": [
    "model_evaluate(y_test, np.ones(len(y_test)))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Confusion matrix\n",
      "[TN FP]\n",
      "[FN TP]\n",
      "[[  273    75]\n",
      " [   46 12769]]\n",
      "Accuracy: 0.9908\n",
      "Precision: 0.9942\n",
      "Recall: 0.9964\n",
      "F1-Score: 0.9953\n",
      "ROC AUC: 0.9831\n"
     ]
    }
   ],
   "source": [
    "model_evaluate(y_test, pipe.predict_proba(X_test))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "application/javascript": [
       "IPython.notebook.save_notebook()\n"
      ],
      "text/plain": [
       "<IPython.core.display.Javascript object>"
      ]
     },
     "metadata": {},
     "output_type": "display_data"
    }
   ],
   "source": [
    "%%javascript\n",
    "IPython.notebook.save_notebook()"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.4"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}