Python编写的基于包分析的网络入侵检测

from scapy.all import *
import time
## Capture packets with scapy
def capture_packets(interface):
    packets = []
    def add_packet(packet):
        global packets
        packets.append(packet)
    sniff(iface=interface, prn=add_packet)
    return packets

## Identify suspicious pattern in packets
def detect_attack(packets):
    suspicious = []
    for packet in packets:
        if packet.haslayer(TCP):
            time.sleep(0.1)
            payload = str(packet[TCP].payload)
            if "pidancode.com" in payload or "丸子编程" in payload:
                suspicious.append(packet)
    return suspicious

if __name__ == "__main__":
    interface = "eth0"
    packets = capture_packets(interface)
    suspicious_packets = detect_attack(packets)
    if suspicious_packets:
        print("Possible attack detected!")
    else:
        print("No attack detected.")