function make_fig2(A, y, cuckoo_idx, splunk_idx, t_created, virus, names)

fold = 2;
cutoff = .3;

I_1 = cv_part(y, fold, cutoff, 'standard', t_created, cuckoo_idx, splunk_idx);
I_2 = cv_part(y, fold, cutoff, 'creation', t_created, cuckoo_idx, splunk_idx);
I_3 = cv_part(y, fold, cutoff, 'type', t_created, cuckoo_idx, splunk_idx, virus);

h = figure;
set(h,'Renderer','painters','Position',[100 900 1000 400]);

subaxis(2,4,1,'Margin',0.00,'Padding',-0.00,'PaddingBottom',0.0,'PaddingTop',0.02,'PaddingLeft',0.02,'PaddingRight',-0.01,'MarginBottom',0.08,'MarginLeft',0.03,'MarginRight',0.10,'MarginTop',0.03);

ha = subaxis(2,4,1,1);
[pred02, pred05, logit_model1] = run(A, y, I_1, false, false, t_created, cuckoo_idx, splunk_idx);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(A)','fontsize',14,'EdgeColor','none');
ylabel('TPR');

ha = subaxis(2,4,2,1);
[~, ~, logit_model2] = run(A, y, I_2, false, true, t_created, cuckoo_idx, splunk_idx);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(B)','fontsize',14,'EdgeColor','none');

ha = subaxis(2,4,3,1);
[~, ~, logit_model3] = run(A, y, I_3, false, false, t_created, cuckoo_idx, splunk_idx);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(C)','fontsize',14,'EdgeColor','none');

ha = subaxis(2,4,4,1);
[h1, h2] = virus_names(y, pred02, pred05, virus);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(D)','fontsize',14,'EdgeColor','none');
pos1 = get(h1,'Position');
set(h1,'Position', [pos1(1)+0.05, pos1(2), pos1(3), pos1(4)]);
if (h1~=h2)
    pos1 = get(h2,'Position');
    set(h2,'Position', [pos1(1)+0.05, pos1(2), pos1(3), pos1(4)]);
    
end


ha = subaxis(2,4,1,2);
[pred02, pred05] = run(A, y, I_1, true, false, t_created, cuckoo_idx, splunk_idx, logit_model1);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(E)','fontsize',14,'EdgeColor','none');
ylabel('TPR');
xlabel('FPR');

ha = subaxis(2,4,2,2);
run(A, y, I_2, true, true, t_created, cuckoo_idx, splunk_idx, logit_model2);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(F)','fontsize',14,'EdgeColor','none');
xlabel('FPR');

ha = subaxis(2,4,3,2);
run(A, y, I_3, true, false, t_created, cuckoo_idx, splunk_idx, logit_model3);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(G)','fontsize',14,'EdgeColor','none');
xlabel('FPR');

ha = subaxis(2,4,4,2);
[h1, h2] = virus_names(y, pred02, pred05, virus);
pos1 = get(gca,'Position');
annotation(h,'textbox',[pos1(1)-0.05,pos1(2)+pos1(4)-0.01,.1,.05],'String','(H)','fontsize',14,'EdgeColor','none');
pos1 = get(h1,'Position');
set(h1,'Position', [pos1(1)+0.05, pos1(2), pos1(3), pos1(4)]);
pos1 = get(h2,'Position');
if (h1~=h2)
    set(h2,'Position', [pos1(1)+0.05, pos1(2), pos1(3), pos1(4)]);
end
xlabel('Fraction Detected');

end

function Ic = valid_cuckoo_only(I, cuckoo_idx)
   
    Ic = {};
    for iter=1:length(I)
      Ic{iter}.training = I{iter}.training | (I{iter}.test & ~cuckoo_idx);
      Ic{iter}.test = I{iter}.test & cuckoo_idx;
   end
end

function [pred02, pred05, logit_model_out] = run(A, y, I, cuckoo_only, time_split, t_created, cuckoo_idx, splunk_idx, logit_model_in)

    A = double(A>0);
    y = double(y>0);
    
    logit = init();
    bagged = init();
    logit2 = init();
    bagged2 = init();
    logit3 = init();
    bagged3 = init();
    
    pred02 = NaN*ones(size(y));
    pred05 = NaN*ones(size(y));
    
    %compute valid
    valid = false(size(y));
    for iter=1:length(I)
        valid = valid | I{iter}.training | I{iter}.test;
    end
    
    logit_model_out = {};
    
    for iter=1:length(I)

        I_train = I{iter}.training;
        I_test = I{iter}.test;
        
        if (time_split)
            
            t_smallest = min(t_created(I_test & t_created>0 & y>0 & cuckoo_idx));

            I_train = valid & I_train & (y==0 | ~cuckoo_idx | t_created<(t_smallest-86400 * 365 *2));            
            I_test = valid & ~I_train & (y==0 | ~cuckoo_idx | t_created<(t_smallest-86400 * 365 *2));
        end
        
        if (sum(I_train & I_test)>0)
            error('Testing and training intersecting.');
        end
        
        A_train = A(I_train, :);
        y_train = y(I_train, :);
        
        if (nargin<9)
            [logit_model, boost_model] = run_pipeline(A_train, y_train);
            logit_model_out{iter} = logit_model;
        else
            logit_model = logit_model_in{iter};
            boost_model = logit_model;
            logit_model_out{iter} = logit_model;
        end
        
        %graft data
        if (cuckoo_only)
            [A_test, y_test, I_test] = gen_graft_data(A,y,cuckoo_idx,splunk_idx, I_test, logit_model);
        else
            I_test = I_test & ~splunk_idx;
            A_test = A(I_test, :);
            y_test = y(I_test, :);
        end
        
        [logit, T02, T05] = record_run(A_test, y_test, logit_model, logit);
        [bagged] = record_run(A_test, y_test, boost_model, bagged);
        
        %record the predictions
        pred02(I_test) = logit_model.predict(A_test)>=T02;
        pred05(I_test) = logit_model.predict(A_test)>=T05;
        
        if (time_split)
            
            I_test = valid & ~I_train & (y==0 | ~cuckoo_idx | t_created>=(t_smallest-86400 * 365 * 1));
            
           if (sum(I_train & I_test)>0)
                error('Testing and training intersecting.');
            end
            
            %A_train = A(I_train, :);
            %y_train = y(I_train, :);
                    
            %[logit_model2, boost_model2] = run_pipeline(A_train, y_train);
            logit_model2 = logit_model;
            boost_model2 = boost_model;
            
            %graft data
            if (cuckoo_only)
                [A_test, y_test,I_test] = gen_graft_data(A,y,cuckoo_idx,splunk_idx, I_test, logit_model2);
            else
                I_test = I_test & ~splunk_idx;
                A_test = A(I_test, :);
                y_test = y(I_test, :);
            end


            [logit2] = record_run(A_test, y_test, logit_model2, logit2);
            [bagged2] = record_run(A_test, y_test, boost_model2, bagged2);
            
            I_test = valid & ~I_train & (y==0 | ~cuckoo_idx | t_created>=(t_smallest-86400 * 365 * 0));

            if (sum(I_train & I_test)>0)
                error('Testing and training intersecting.');
            end
            
            %A_train = A(I_train, :);
            %y_train = y(I_train, :);
        
            %[logit_model3, boost_model3] = run_pipeline(A_train, y_train);
            logit_model3 = logit_model;
            boost_model3 = boost_model;


            %graft data
            if (cuckoo_only)
                [A_test, y_test,I_test] = gen_graft_data(A,y,cuckoo_idx,splunk_idx, I_test, logit_model3);
            else
                I_test = I_test & ~splunk_idx;
                A_test = A(I_test, :);
                y_test = y(I_test, :);
            end
            
            [logit3] = record_run(A_test, y_test, logit_model3, logit3);
            [bagged3] = record_run(A_test, y_test, boost_model3, bagged3);
 
        end
        
    end

    if (time_split)
        semilogx(mean(logit.X) , mean(logit.Y),'-k', mean(logit2.X) , mean(logit2.Y),'-b', mean(logit3.X) , mean(logit3.Y),'-r', mean(bagged.X) , mean(bagged.Y), '--k', mean(bagged2.X) , mean(bagged2.Y), '--b', mean(bagged3.X) , mean(bagged3.Y), '--r');
        legend(sprintf('0 year, AUC=%.2f', mean(logit.AUC)), sprintf('1 year, AUC=%.2f', mean(logit2.AUC)), sprintf('2 year, AUC=%.2f', mean(logit3.AUC)), 'Location','SouthEast');
        %plot(mean(logit.X) , mean(logit.Y),'-k', mean(logit2.X) , mean(logit2.Y),'-r');
        %legend(sprintf('LR, AUC=%.2f, 1 year', mean(logit.AUC)), sprintf('LR, AUC=%.2f, 2 years', mean(logit2.AUC)), 'Location','SouthEast');
    else

        semilogx(mean(logit.X) , mean(logit.Y),'-k', mean(bagged.X) , mean(bagged.Y), '--k');
        legend(sprintf('AUC=%.2f', mean(logit.AUC)), 'Location','SouthEast');
        %plot(mean(logit.X) , mean(logit.Y),'-k');        
    end  
    
    xlim([2e-4, 0.1]);
    ylim([0, 1.0]);
    set(gca, 'XMinorTick','on','YMinorTick','on','TickLength',[0.025 0.025]);

end

function [base] = init()
    base.X = [];
    base.Y = [];
    base.AUC = [];
    base.AUC_splunk = [];
end

function [base,T02, T05] = record_run(A, y, model, base)

    [X,Y,T,auc] = model.getROCPoints(A, y);
    
    T02 = T(find(X>=.01,1,'first'));
    T05 = T(find(X>=.001,1,'first'));
    AUC_splunk = 0;
    
    base.X(end+1,:) = X;
    base.Y(end+1,:) = Y;
    base.AUC(end+1) = auc;
    base.AUC_splunk(end+1) = AUC_splunk;

end


 function [h1, h2] = virus_names(y, pred02, pred05, virus)

    if (sum(~isnan(pred02))==0)
        h1 = gca;
        %h2 = axes();
        h2 = gca;
        return;
    end
 
 
  for iter=1:length(virus)
      if (strcmp(virus{iter}, 'Trojan.Win32.Generic'))
          virus{iter} = 'Generic';
      else
        x = strsplit(virus{iter},'.');
        virus{iter} = lower(x{1});
        x = strsplit(virus{iter},'-');
        virus{iter} = lower(x{1});
      end
  end
  
  [unique_names,~,z] = unique(virus);
  d = hist(max(0, z(y>0 & ~isnan(pred02))),length(unique_names));
  
  d_after = hist(z(y>0 & pred05>0),length(unique_names));
  d_after2 = hist(z(y>0 & pred02>0),length(unique_names));
  
  [~,I] = sort(d,'descend');
  
  I_label = [];
  for iter=1:length(I)
    if (strcmp(unique_names(I(iter)),'<nolabel>')==0 && strcmp(unique_names(I(iter)),'Generic')==0)
      I_label = [I_label I(iter)];
    end
    
    if (length(I_label)>=10)
      break;
    end
  end
  
  barh([d_after(I_label)'./d(I_label)', d_after2(I_label)'./d(I_label)']);
  
  hold on;
  
  set(gca, 'YDir','reverse');
  set(gca,'YTickLabel',unique_names(I_label), 'XMinorTick','on','TickLength',[0.025 0.025]);
  ylabel('Kaspersky Classification');
  xlim([0, 1.0]);
  h1 = gca;
  
  %legend('FPR=10^{-2}', 'FPR=10^{-3}','Location','SouthWest' );
  %legend('boxoff');
  
  h2 = axes('Position',get(gca,'Position'),...
              'XAxisLocation','top',...
              'YAxisLocation','right',...
              'Color','none');
            
  set(h2, 'Ylim', get(h1,'Ylim'), 'YDir','reverse', 'XTickLabel', [], 'YTickLabel', d(I_label), 'YTick', 1:length(I_label));
  ylabel(h2, '# Observations');
  axes(h1);
  
 end
 