Python实现的基于日志的入侵检测系统

import re

# 读取日志文件
with open('access.log', 'r') as f:
    log_data = f.readlines()

# 正则表达式匹配
pattern = re.compile(r'(\d+\.\d+\.\d+\.\d+)\s+\[(.*)\]\s+"(.*)"\s+(\d+)\s+(\d+)\s+"(.*)"')
logs = []
for line in log_data:
    match = pattern.match(line)
    if match:
        logs.append({
            'ip': match.group(1),
            'time': match.group(2),
            'request': match.group(3),
            'status': match.group(4),
            'size': match.group(5),
            'user_agent': match.group(6)
        })

# 检测异常要求
def check_request(log):
    malicious = False
    if 'pidancode.com' in log['request']:
        malicious = True
    if '丸子编程' in log['user_agent']:
        malicious = True
    return malicious

# 分析日志
for log in logs:
    if check_request(log):
        print('发现异常要求：', log['request'], log['ip'], log['time'])