PM-pinou
495 lines
20 KiB
Python
495 lines
20 KiB
Python
"""CSV loading with per-file schema validation, BOM detection, and multi-file merge.
|
||
|
||
Supports multiple encodings and delimiter-separated files. The main entry
|
||
point is :func:`load_csv_directory`, which globs files, detects BOM per file,
|
||
validates schema consistency, and returns a merged :class:`pl.LazyFrame`.
|
||
"""
|
||
import glob
|
||
import logging
|
||
import os
|
||
from pathlib import Path
|
||
from typing import Optional
|
||
|
||
import polars as pl
|
||
import yaml
|
||
|
||
from analysis.type_classifier import classify_schema, DataType
|
||
|
||
logger = logging.getLogger(__name__)
|
||
|
||
|
||
SUPPORTED_ENCODINGS = ['utf-8', 'utf-8-sig', 'utf-16le', 'utf-16be', 'latin-1']
|
||
|
||
|
||
# ── numeric coercion helper ──────────────────────────────────────────────
|
||
|
||
def _coerce_to_float(series: pl.Series) -> pl.Series:
|
||
"""Convert string series to Float64.
|
||
|
||
Every entry that doesn't parse as a valid float becomes null.
|
||
Handles blank strings, standalone '+'/'-', 'N/A', 'null', 'None', etc.
|
||
"""
|
||
series = series.cast(pl.Utf8).str.strip_chars()
|
||
artifacts = ('', '+', '-', '.', '..', 'N/A', 'n/a', 'NA', 'null', 'None', 'NULL', '?', '---', '--', '/')
|
||
is_artifact = series.is_in(pl.Series(artifacts).implode())
|
||
result = []
|
||
for v, bad in zip(series.to_list(), is_artifact.to_list()):
|
||
if v is None or bad:
|
||
result.append(None)
|
||
else:
|
||
# Check for "+"/"-" prefix artifacts (e.g., "+abc", "-xyz")
|
||
# where the value isn't a genuine numeric string. Values like
|
||
# "+5" or "-3.14" are still accepted as valid floats below.
|
||
if len(v) > 1 and v[0] in '+-':
|
||
try:
|
||
float(v[1:]) # validate suffix minus prefix
|
||
except ValueError:
|
||
result.append(None)
|
||
continue
|
||
try:
|
||
result.append(float(v))
|
||
except (ValueError, TypeError):
|
||
result.append(None)
|
||
return pl.Series(result, dtype=pl.Float64)
|
||
|
||
|
||
# ── BOM detection ───────────────────────────────────────────────────────
|
||
|
||
def detect_bom(path: str) -> str:
|
||
"""Read the first 4 bytes of *path* and return the detected encoding.
|
||
|
||
Returns ``'utf-8'`` when no BOM is found.
|
||
|
||
Note: Python 3 ``open()`` fully supports Unicode/Chinese paths on all
|
||
platforms (no encoding dance needed).
|
||
"""
|
||
with open(path, 'rb') as f:
|
||
header = f.read(4)
|
||
|
||
if header[:3] == b'\xef\xbb\xbf':
|
||
return 'utf-8-sig'
|
||
if header[:2] == b'\xff\xfe':
|
||
return 'utf-16le'
|
||
if header[:2] == b'\xfe\xff':
|
||
return 'utf-16be'
|
||
return 'utf-8'
|
||
|
||
|
||
# ── schema utilities ────────────────────────────────────────────────────
|
||
|
||
def collect_schema(
|
||
path: str,
|
||
encoding: str = 'utf-8',
|
||
delimiter: str = ',',
|
||
sample_rows: int = 10000,
|
||
) -> dict:
|
||
"""Return {column_name: dtype_string} for a single CSV file.
|
||
|
||
Uses :func:`pl.scan_csv` with *sample_rows* rows for type inference.
|
||
"""
|
||
lf = pl.scan_csv(
|
||
str(path), # str() ensures Unicode/Chinese paths resolve correctly
|
||
encoding=encoding,
|
||
separator=delimiter,
|
||
infer_schema_length=sample_rows,
|
||
)
|
||
schema = lf.collect_schema()
|
||
return {name: str(dtype) for name, dtype in zip(schema.names(), schema.dtypes())}
|
||
|
||
|
||
def _merge_schema_entries(
|
||
schemas: list[dict],
|
||
) -> dict:
|
||
"""Merge multiple schema dicts, raising on type conflicts.
|
||
|
||
Returns a single {name: dtype} dict. If a column appears in multiple
|
||
files with different dtypes the *last* non-null dtype wins (with a
|
||
warning embedded in the result).
|
||
"""
|
||
merged: dict[str, str] = {}
|
||
conflicts: list[str] = []
|
||
for s in schemas:
|
||
for name, dtype in s.items():
|
||
if name in merged and merged[name] != dtype:
|
||
conflicts.append(name)
|
||
merged[name] = dtype # last wins
|
||
return merged, conflicts
|
||
|
||
|
||
def validate_schemas(schemas: list[dict]) -> None:
|
||
"""Compare schemas across files and raise :class:`ValueError` on mismatch.
|
||
|
||
Checks that every file has the same set of column names. Type
|
||
differences across files are **not** considered an error (Polars can
|
||
cast), but differences in *column sets* are.
|
||
"""
|
||
if not schemas:
|
||
return
|
||
|
||
col_sets = [set(s.keys()) for s in schemas]
|
||
reference = col_sets[0]
|
||
|
||
for i, cs in enumerate(col_sets[1:], start=1):
|
||
only_in_ref = reference - cs
|
||
only_in_current = cs - reference
|
||
if only_in_ref or only_in_current:
|
||
msg_parts = []
|
||
if only_in_ref:
|
||
msg_parts.append(f"File #{i} missing columns: {sorted(only_in_ref)}")
|
||
if only_in_current:
|
||
msg_parts.append(f"File #{i} has extra columns: {sorted(only_in_current)}")
|
||
raise ValueError(f"Schema mismatch: {'; '.join(msg_parts)}")
|
||
|
||
|
||
# ── dtype inference from schema ─────────────────────────────────────────
|
||
|
||
def detect_schema_dtypes(
|
||
lf: pl.LazyFrame,
|
||
sample_rows: int = 10000,
|
||
) -> dict:
|
||
"""Infer Polars dtype strings from a LazyFrame's schema.
|
||
|
||
The schema is read without collecting the full data (the scan scans
|
||
a small sample).
|
||
"""
|
||
schema = lf.collect_schema()
|
||
return {name: str(dtype) for name, dtype in zip(schema.names(), schema.dtypes())}
|
||
|
||
|
||
# ── config loading ──────────────────────────────────────────────────────
|
||
|
||
def load_config(config_path: Optional[str]) -> dict:
|
||
"""Load a YAML config file; returns an empty dict if *config_path* is None."""
|
||
if config_path is None:
|
||
return {}
|
||
path = Path(config_path)
|
||
if not path.exists():
|
||
raise FileNotFoundError(f"Config file not found: {config_path}")
|
||
with open(path, 'r', encoding='utf-8') as f:
|
||
return yaml.safe_load(f) or {}
|
||
|
||
|
||
# ── helpers ─────────────────────────────────────────────────────────────
|
||
|
||
def _file_count(paths: list[str]) -> int:
|
||
return len(paths)
|
||
|
||
|
||
def _resolve_encoding(encoding: str, file_encoding: str) -> str:
|
||
"""BOM-detected encoding overrides user-supplied encoding.
|
||
|
||
Polars >= 1.0 requires ``'utf8'`` (not ``'utf-8'``).
|
||
"""
|
||
resolved = file_encoding if file_encoding != 'utf-8' else encoding
|
||
return resolved.replace('-', '') if resolved in ('utf-8', 'utf-8-sig') else resolved
|
||
|
||
|
||
# ── main entry ──────────────────────────────────────────────────────────
|
||
|
||
def load_csv_directory(
|
||
glob_pattern: str,
|
||
encoding: str = 'utf-8',
|
||
delimiter: str = ',',
|
||
config_path: Optional[str] = None,
|
||
schema_override: Optional[dict] = None,
|
||
sample_rows: int = 10000,
|
||
schema_strict: bool = False,
|
||
recursive: bool = False,
|
||
head: Optional[int] = None,
|
||
) -> tuple[pl.LazyFrame, dict, int, int, float]:
|
||
"""Load, validate, and merge CSV files matching *glob_pattern*.
|
||
|
||
Args:
|
||
glob_pattern: Glob pattern for CSV files (e.g. ``data/*.csv``).
|
||
encoding: Fallback encoding when no BOM is detected.
|
||
delimiter: Column delimiter character.
|
||
config_path: Optional path to a YAML config (merged into metadata).
|
||
schema_override: If given, force these {column: dtype} overrides.
|
||
sample_rows: Rows to scan for dtype inference per file.
|
||
schema_strict: When True, raise ValueError on column mismatch across
|
||
files. When False (default), log warnings and merge with
|
||
``diagonal_relaxed`` (missing columns get null).
|
||
recursive: When True, use ``glob.glob(..., recursive=True)`` to
|
||
support ``**/*.csv`` patterns.
|
||
head: Optional row limit for preview scenarios. When set, applies
|
||
``lf.head(head)`` before returning.
|
||
|
||
Returns:
|
||
A tuple of ``(lazyframe, schema_dict, total_row_count, file_count,
|
||
memory_estimate_mb)``.
|
||
|
||
Raises:
|
||
FileNotFoundError: If no files match the glob pattern.
|
||
ValueError: If schemas are inconsistent across files and
|
||
*schema_strict* is True.
|
||
"""
|
||
# Normalise path separators for cross-platform Unicode support
|
||
glob_pattern = os.path.normpath(glob_pattern)
|
||
|
||
# Resolve file list
|
||
paths = sorted(glob.glob(glob_pattern, recursive=recursive))
|
||
if not paths and not recursive:
|
||
# Fallback: try recursive pattern
|
||
paths = sorted(glob.glob(glob_pattern, recursive=True))
|
||
if not paths:
|
||
raise FileNotFoundError(f"No files match glob pattern: {glob_pattern}")
|
||
|
||
# Load config (user-provided or fall back to project default)
|
||
config = load_config(config_path)
|
||
if not config:
|
||
default_path = Path(__file__).parent.parent / 'config' / 'config.yaml'
|
||
if default_path.exists():
|
||
config = load_config(str(default_path))
|
||
|
||
# Collect per-file schema
|
||
schemas: list[dict] = []
|
||
lazyframes: list[pl.LazyFrame] = []
|
||
for path in paths:
|
||
file_encoding = detect_bom(path)
|
||
actual_encoding = _resolve_encoding(encoding, file_encoding)
|
||
|
||
lf = pl.scan_csv(
|
||
str(path), # str() ensures Unicode/Chinese paths resolve correctly
|
||
encoding=actual_encoding,
|
||
separator=delimiter,
|
||
infer_schema_length=max(sample_rows, 1000),
|
||
)
|
||
schema = detect_schema_dtypes(lf, sample_rows=sample_rows)
|
||
|
||
# Apply schema override for this file
|
||
if schema_override:
|
||
for col, dtype in schema_override.items():
|
||
if col in schema:
|
||
schema[col] = dtype
|
||
|
||
schemas.append(schema)
|
||
lazyframes.append(lf)
|
||
|
||
if schema_strict:
|
||
# Raise on column mismatch
|
||
validate_schemas(schemas)
|
||
else:
|
||
# Lenient mode: log warnings for column mismatches
|
||
col_sets = [set(s.keys()) for s in schemas]
|
||
reference = col_sets[0]
|
||
for i, cs in enumerate(col_sets[1:], start=1):
|
||
only_in_ref = reference - cs
|
||
only_in_current = cs - reference
|
||
if only_in_ref:
|
||
logger.warning(
|
||
"File #%d missing columns: %s (will be null)",
|
||
i + 1, sorted(only_in_ref),
|
||
)
|
||
if only_in_current:
|
||
logger.warning(
|
||
"File #%d has extra columns: %s (will be null in other files)",
|
||
i + 1, sorted(only_in_current),
|
||
)
|
||
|
||
# Merge schemas (unify column ordering — first file wins order)
|
||
merged_schema, _ = _merge_schema_entries(schemas)
|
||
|
||
# Concatenate all LazyFrames (union vertically)
|
||
merged_lf: pl.LazyFrame = pl.concat(lazyframes, how='diagonal_relaxed')
|
||
|
||
# Log schema and size estimate
|
||
total_row_count_est = len(paths) * (lazyframes[0].collect(streaming=True).height if lazyframes else 0)
|
||
logger.info(f'[LOAD] files={len(paths)} total_rows_est={total_row_count_est}')
|
||
for col_name, dtype in sorted(merged_schema.items()):
|
||
logger.info(f'[LOAD_SCHEMA] col={col_name} dtype={dtype}')
|
||
|
||
# Apply schema override on merged frame (cast columns)
|
||
if schema_override:
|
||
casts = {}
|
||
for col, dtype_str in schema_override.items():
|
||
if col in merged_schema:
|
||
try:
|
||
polars_dtype = getattr(pl, dtype_str.split('(')[0], None)
|
||
if polars_dtype:
|
||
casts[col] = pl.col(col).cast(polars_dtype)
|
||
except Exception:
|
||
pass # skip uncastable overrides silently
|
||
if casts:
|
||
merged_lf = merged_lf.with_columns(list(casts.values()))
|
||
|
||
# ── Cleaning: drop outdated columns ──────────────────────────────────
|
||
geoip_cfg = config.get('data', {}).get('geoip', {})
|
||
drop_cols = geoip_cfg.get(
|
||
'drop_columns',
|
||
[], # Empty by default — lat/lon columns are now cleaned, not dropped
|
||
)
|
||
existing_drop = [c for c in drop_cols if c in merged_schema]
|
||
if existing_drop:
|
||
merged_lf = merged_lf.drop(existing_drop)
|
||
merged_schema = {k: v for k, v in merged_schema.items() if k not in existing_drop}
|
||
logger.info('[CLEAN] dropped columns: %s', existing_drop)
|
||
|
||
# ── Cleaning: BOOL_ENUM normalisation ────────────────────────────────
|
||
try:
|
||
type_map = classify_schema(
|
||
merged_lf.head(1000),
|
||
config_overrides=config.get('columns', {}),
|
||
)
|
||
except Exception:
|
||
type_map = {}
|
||
|
||
bool_enum_cols = [
|
||
c for c, t in type_map.items()
|
||
if t == DataType.BOOL_ENUM and c in merged_schema
|
||
]
|
||
if bool_enum_cols:
|
||
# Only clean string-typed BOOL_ENUM columns; native Boolean is already clean
|
||
schema_dtypes = dict(zip(
|
||
merged_lf.collect_schema().names(),
|
||
merged_lf.collect_schema().dtypes(),
|
||
))
|
||
bool_exprs = []
|
||
cleaned_names: list[str] = []
|
||
for c in bool_enum_cols:
|
||
if schema_dtypes.get(c) not in (pl.Utf8, pl.String):
|
||
continue # native Boolean / numeric — skip
|
||
c_str = pl.col(c).cast(pl.Utf8).str.strip_chars()
|
||
cleaned = (
|
||
pl.when(c_str == "")
|
||
.then(pl.lit(None, pl.Utf8))
|
||
.when(c_str.str.to_lowercase() == "+")
|
||
.then(pl.lit("True"))
|
||
.when(c_str.str.to_lowercase() == "-")
|
||
.then(pl.lit("False"))
|
||
.otherwise(c_str)
|
||
)
|
||
bool_exprs.append(cleaned.alias(c))
|
||
cleaned_names.append(c)
|
||
if bool_exprs:
|
||
merged_lf = merged_lf.with_columns(bool_exprs)
|
||
for c in cleaned_names:
|
||
merged_schema[c] = 'Utf8'
|
||
logger.info('[CLEAN] BOOL_ENUM columns normalised: %s', cleaned_names)
|
||
|
||
# ── Cleaning: LAT_LON normalisation ────────────────────────────────
|
||
latlon_cols = [
|
||
c for c, t in type_map.items()
|
||
if t == DataType.LAT_LON and c in merged_schema
|
||
]
|
||
if latlon_cols:
|
||
schema_dtypes_ll = dict(zip(
|
||
merged_lf.collect_schema().names(),
|
||
merged_lf.collect_schema().dtypes(),
|
||
))
|
||
latlon_exprs = []
|
||
for c in latlon_cols:
|
||
dtype = schema_dtypes_ll.get(c)
|
||
if dtype in (pl.Utf8, pl.String):
|
||
latlon_exprs.append(
|
||
pl.col(c).map_batches(_coerce_to_float, return_dtype=pl.Float64).alias(c)
|
||
)
|
||
merged_schema[c] = 'Float64'
|
||
if latlon_exprs:
|
||
merged_lf = merged_lf.with_columns(latlon_exprs)
|
||
logger.info('[CLEAN] LAT_LON columns normalised to Float64: %s', latlon_cols)
|
||
|
||
# ── Cleaning: Generic numeric coercion ────────────────────────────
|
||
# For any remaining string column (not IPv4/URL/HEX/ENUM/etc.),
|
||
# try to coerce to Float64. Whatever can't parse becomes null.
|
||
# This prevents "mean on str column" crashes for ANY column.
|
||
_SKIP_NUM_COERCE = (DataType.IPv4, DataType.URL, DataType.HEX,
|
||
DataType.ENUM, DataType.LAT_LON)
|
||
# Also protect columns with these name patterns (MAC addresses, etc.)
|
||
_SKIP_NAME_PATTERNS = ('mac', 'mac_', '_mac', 'addr', 'address')
|
||
schema_dtypes_gn = dict(zip(
|
||
merged_lf.collect_schema().names(),
|
||
merged_lf.collect_schema().dtypes(),
|
||
))
|
||
generic_numeric_cols = []
|
||
for c, t in type_map.items():
|
||
if t in _SKIP_NUM_COERCE:
|
||
continue
|
||
if c not in merged_schema:
|
||
continue
|
||
dtype = schema_dtypes_gn.get(c)
|
||
if dtype not in (pl.Utf8, pl.String):
|
||
continue # already numeric
|
||
# Skip columns with protected name patterns
|
||
cl = c.lower().replace('-', '_').replace(' ', '_')
|
||
if any(p in cl for p in _SKIP_NAME_PATTERNS):
|
||
continue
|
||
generic_numeric_cols.append(c)
|
||
|
||
if generic_numeric_cols:
|
||
num_exprs = []
|
||
for c in generic_numeric_cols:
|
||
num_exprs.append(
|
||
pl.col(c).map_batches(_coerce_to_float, return_dtype=pl.Float64).alias(c)
|
||
)
|
||
if num_exprs:
|
||
merged_lf = merged_lf.with_columns(num_exprs)
|
||
for c in generic_numeric_cols:
|
||
merged_schema[c] = 'Float64'
|
||
logger.info('[CLEAN] Generic numeric coercion applied: %s', generic_numeric_cols)
|
||
|
||
# ── Cleaning: HEX preprocessing (hex_pairs_count) ────────────────────
|
||
hex_cols = [
|
||
c for c, t in type_map.items()
|
||
if t == DataType.HEX and c in merged_schema
|
||
]
|
||
if hex_cols:
|
||
hex_exprs = []
|
||
for c in hex_cols:
|
||
hex_exprs.append(
|
||
pl.col(c).str.split(" ").list.len().alias(f"{c}_hex_pairs_count")
|
||
)
|
||
merged_lf = merged_lf.with_columns(hex_exprs)
|
||
for c in hex_cols:
|
||
merged_schema[f"{c}_hex_pairs_count"] = 'UInt32'
|
||
logger.info('[CLEAN] HEX columns added hex_pairs_count: %s', hex_cols)
|
||
|
||
# ── Value normalization (TLS hex→enum, display→enum) ────────────────
|
||
from analysis.value_normalizer import normalize_lf
|
||
merged_lf = normalize_lf(merged_lf, type_map)
|
||
# Only add _norm columns to schema if the source column exists in type_map
|
||
_NORM_MAP = [
|
||
('0ver', '0ver_norm'),
|
||
('0cph', '0cph_norm'),
|
||
('cipher-suite', 'cipher_suite_norm'),
|
||
('0crv', '0crv_norm'),
|
||
('ecdhe-named-curve', 'ecdhe_named_curve_norm'),
|
||
('cnrs', 'cnrs_norm'),
|
||
('isrs', 'isrs_norm'),
|
||
]
|
||
_added = []
|
||
for src, tgt in _NORM_MAP:
|
||
if src in type_map:
|
||
merged_schema[tgt] = 'Utf8'
|
||
_added.append(tgt)
|
||
if _added:
|
||
logger.info('[CLEAN] Value normalization columns added: %s', _added)
|
||
|
||
# Row count estimate (fast path: use first file row count × files)
|
||
# For accurate count we'd need to collect, but that defeats lazy.
|
||
# We estimate from the first file's scanned schema info.
|
||
first_rows = lazyframes[0].collect(streaming=True).height if lazyframes else 0
|
||
total_row_count = first_rows * len(paths)
|
||
|
||
# Memory estimate
|
||
bytes_per_row = 0
|
||
for col_name, dtype_str in merged_schema.items():
|
||
numeric_part = dtype_str.split('(')[0].lower()
|
||
size_map = {
|
||
'int8': 1, 'int16': 2, 'int32': 4, 'int64': 8,
|
||
'uint8': 1, 'uint16': 2, 'uint32': 4, 'uint64': 8,
|
||
'float32': 4, 'float64': 8,
|
||
'boolean': 1, 'bool': 1,
|
||
'utf8': 50, 'string': 50, 'str': 50,
|
||
'categorical': 8, 'cat': 8,
|
||
'date': 4, 'datetime': 8, 'time': 8, 'duration': 8,
|
||
}
|
||
bytes_per_row += size_map.get(numeric_part, 8)
|
||
memory_mb = (bytes_per_row * total_row_count) / (1024 * 1024)
|
||
|
||
# Apply head limit for preview (keeps LazyFrame lazy — rows are limited on collect)
|
||
if head is not None:
|
||
merged_lf = merged_lf.head(head)
|
||
total_row_count = min(total_row_count, head)
|
||
|
||
return merged_lf, merged_schema, total_row_count, len(paths), memory_mb
|