hareeshnaidu123/loganalyzer.py
GitHub: hareeshnaidu123/loganalyzer.py
使用 Python 解析 Linux 认证日志以检测 SSH 暴力破解尝试并生成 CSV 分析报告的轻量安全监控脚本。
Stars: 0 | Forks: 0
# loganalyzer.py
import re
import pandas as pd
from collections import Counter
LOG_FILE = "sample_auth.log"
failed_pattern = r"Failed password.*from (\d+\.\d+\.\d+\.\d+)"
success_pattern = r"Accepted password.*from (\d+\.\d+\.\d+\.\d+)"
failed_ips = []
success_ips = []
with open(LOG_FILE, "r") as file:
for line in file:
failed = re.search(failed_pattern, line)
success = re.search(success_pattern, line)
```
if failed:
failed_ips.append(failed.group(1))
if success:
success_ips.append(success.group(1))
```
failed_count = Counter(failed_ips)
success_count = Counter(success_ips)
print("=" * 50)
print("日志分析报告")
print("=" * 50)
print(f"\n总失败登录次数 : {len(failed_ips)}")
print(f"总成功登录次数 : {len(success_ips)}")
print("\n失败登录 IP")
for ip, count in failed_count.items():
print(f"{ip} --> {count}")
print("\n成功登录 IP")
for ip, count in success_count.items():
print(f"{ip} --> {count}")
print("\n可能的暴力破解尝试")
for ip, count in failed_count.items():
if count >= 3:
print(f"警告 : {ip} 尝试了 {count} 次失败登录")
report = []
for ip, count in failed_count.items():
report.append({
"IP Address": ip,
"Failed Attempts": count,
"Status": "可疑" if count >= 3 else "正常"
})
df = pd.DataFrame(report)
df.to_csv("report.csv", index=False)
print("\nCSV 报告已保存为 report.csv")
标签：Python, Ubuntu, 代码示例, 数据分析, 无后门, 网络调试, 自动化, 逆向工具