Python-Security-Log-Analyzer

Python-based cybersecurity tool that analyzes Linux SSH authentication logs to identify suspicious activity. Detects failed login attempts, potential brute-force attacks, and suspicious IP addresses while generating structured security reports for threat analysis.

Overview

This project simulates a lightweight Security Operations Center (SOC) monitoring tool by parsing Linux authentication logs and identifying potentially malicious behavior. The analyzer processes SSH login events, tracks failed and successful authentication attempts, flags suspicious IP addresses, and detects brute-force attacks using time-based analysis.

Features

• Parse Linux SSH authentication logs
• Detect failed login attempts by IP address
• Track successful user logins
• Identify suspicious IP addresses based on configurable thresholds
• Detect brute-force attacks using time-window analysis
• Generate detailed security reports
• Export findings to a text report

Technologies Used

• Python 3
• Regular Expressions (Regex)
• Datetime Processing
• File Handling
• Linux Authentication Logs
• Data Structures (Lists, Dictionaries)

Project Structure

Python-SSH-Log-Analyzer/
│
├── log-analyzer.py
├── sample_auth.log
├── security_report.txt
├── README.md
└── LICENSE

How It Works

The analyzer scans Linux SSH authentication logs and searches for:

Failed Login Attempts

Example:

Jun 03 08:12:44 web01 sshd[1027]: Failed password for invalid user admin from 192.168.1.45 port 52525 ssh2

Successful Logins

Example:

Jun 03 08:12:11 web01 sshd[1021]: Accepted password for ashton from 10.0.0.22 port 51515 ssh2

Brute Force Detection

The program identifies IP addresses that generate multiple failed login attempts within a 60-second window.

Default Detection Rule:

5 or more failed login attempts
within 60 seconds
from the same IP address

Sample Output

==============================
 Security Analysis Report
==============================

Failed Login Attempts:
192.168.1.45: 16
203.0.113.77: 9
198.51.100.23: 5

Successful Logins:
User: ashton | IP: 10.0.0.22
User: deploy | IP: 10.0.0.15
User: jdoe | IP: 10.0.0.30
User: analyst | IP: 10.0.0.55

Suspicious IP Addresses:
ALERT: 192.168.1.45 exceeded 5 failed attempts
ALERT: 203.0.113.77 exceeded 5 failed attempts
ALERT: 198.51.100.23 exceeded 5 failed attempts

Brute Force Detection:
HIGH THREAT: 192.168.1.45 (8 failures within 60 seconds)
HIGH THREAT: 203.0.113.77 (5 failures within 60 seconds)

Learning Objectives

This project was created to strengthen skills in:

• Cybersecurity Monitoring
• Security Log Analysis
• Linux Authentication Systems
• Threat Detection
• Python Development
• Security Automation
• Incident Analysis

Future Improvements

• CSV report exports
• Command-line arguments
• User activity analysis
• Multiple log source support
• Threat severity scoring
• Dashboard visualization

Author

Ashton Burgess

Cybersecurity Graduate

License

This project is licensed under the MIT License.