%let name=mc2e;
filename odsout '.';

%let mc2path=\\l72586.na.sas.com\public\VAST_2011\MC_2_Core_Data\;

libname mydata "&mc2path";



%let background_image=&mc2path.mc2_pic.jpg;

%let xsize=835;
%let ysize=717;

/* The paper size needs to be a little bigger, to make room for the titles */
%let xpaper=900;
%let ypaper=900;
goptions xpixels=&xpaper ypixels=&ypaper;


/*
This is the blank rectangular outline of the casino floorplan map
(make sure it's the same proportions as the original map).
You will later 'annotate' the floorplan image into this area.
*/
data floorplan_blank;
 idnum=1;
 x=0; y=0; output;
 x=&xsize; y=0; output;
 x=&xsize; y=&ysize; output;
 x=0; y=&ysize; output;
run;


data id_loc;
length id_num $20;
input id_num x y;
/* flip the y-value, since SAS/GRAPH's coordinate system starts at bottom/left */
y=&ysize-y;
datalines;
192.168.2.10-250 715 562
172.20.1.1 294 242
172.20.1.5 67 243
192.168.1.50 132 370
192.168.1.16 405 350
192.168.1.7 92 625
192.168.1.6 167 558
192.168.1.5 232 614
192.168.1.4 324 545
192.168.1.3 403 599
192.168.1.2 477 535
192.168.1.14 550 580
10.200.150.x 297 69
;
run;

/* Which areas had security risks?*/
proc sql;
create table intrusions as
select unique source_ip, count(*) as intrusion_count
from mydata.ids
group by source_ip;
quit; run;

data intrusions; set intrusions;
id_num=source_ip;
if substr(source_ip,1,10)='192.168.2.' then id_num='192.168.2.10-250';
if substr(source_ip,1,11)='10.200.150.' then id_num='10.200.150.x';
run;

proc sql;
create table anno_dots as
select intrusions.*, id_loc.x, id_loc.y
from intrusions left join id_loc
on intrusions.id_num = id_loc.id_num;
quit; run;


/*
Create an annotated dot for each id_loc 
*/
data anno_dots; set anno_dots;
length function color $8;
xsys='2'; ysys='2'; hsys='3'; when='a';   
length html $100;
html='href='||quote('#_'||trim(left(id_num)))||
 ' title='||quote(trim(left(id_num)));
function='pie'; rotate=360; style='pempty'; width=2; size=6;
color='red';
output;
run;


/*
This is the floorplan image you'll annotate onto the blank rectangular gmap.
*/
data anno_floorplan;
length  function $8;
xsys='2'; ysys='2'; hsys='3'; when='b'; 
function='move'; x=0; y=0; output;
function='image'; x=&xsize; y=&ysize; style='fit';
 imgpath="&background_image"; output;
run;


GOPTIONS DEVICE=png;
ODS LISTING CLOSE;
ODS HTML path=odsout body="&name..htm" style=minimal;

goptions gunit=pct ftitle="albany amt/bold" ftext="albany amt" htitle=3 htext=2;

pattern1 v=empty;

title1 ls=1.5 "Intrustion Detection System (IDS) - by Source IP";
title2 "intrusions circled in " c=red "red" c=black " (click red circle to see details)";
proc gmap data=floorplan_blank map=floorplan_blank anno=anno_floorplan; 
 id idnum; 
 choro idnum / nolegend coutline=black
 anno=anno_dots
 des="" name="&name"; 
run;





proc sql noprint;
create table summary as
select unique source_ip, date, violation, count(*) as count
from mydata.ids
group by source_ip, date, violation
order by source_ip, date, violation;
quit; run;

data summary; set summary;
id_num=source_ip;
if substr(source_ip,1,10)='192.168.2.' then id_num='192.168.2.10-250';
if substr(source_ip,1,11)='10.200.150.' then id_num='10.200.150.x';
run;

%macro do_table(id_num);
ods html anchor="_&id_num";
data tempdata; set summary (where=(id_num="&id_num")); run;
title "Intrusion Detection summary for " color=red "#byval(id_num)";
options nocenter nobyline;
proc print data=tempdata noobs;
by id_num;
var source_ip date count violation;
run;
%mend do_table;

/* Loop through, and make a plot for each manufacturer */
proc sql noprint;
create table loopdata as
select unique id_num
from summary;
quit; run;
data _null_; set loopdata;
   call execute('%do_table('|| id_num ||');');
run;



quit;
ODS HTML CLOSE;
ODS LISTING;