\u5728\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528<\/a>\u74b0\u5883\u7684\u52d5\u614b\u683c\u5c40\u4e2d,\u7406\u89e3\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u4e0d\u50c5\u50c5\u662f\u76e3\u63a7\u6d41\u91cf<\/a>\u2014\u2014\u5b83\u662f\u95dc\u65bc\u63ed\u793a\u6bcf\u500b\u8acb\u6c42\u3001\u9023\u7d50\u548c\u6f5b\u5728\u5b89\u5168\u5a01\u8105\u80cc\u5f8c\u7684\u6545\u4e8b\u3002\u5c0d\u65bc\u7ba1\u7406\u9ad8\u6d41\u91cf\u57fa\u790e\u8a2d\u65bd\u7684\u6280\u8853\u5c08\u696d\u4eba\u54e1\u4f86\u8aaa,\u638c\u63e1\u65e5\u8a8c\u5206\u6790\u6210\u70ba\u5340\u5206\u5065\u5168\u7cfb\u7d71\u548c\u8106\u5f31\u7cfb\u7d71\u7684\u95dc\u9375\u6280\u80fd\u3002<\/p>\n \u8b93\u6211\u5011\u6df1\u5165\u4e86\u89e3\u4f3a\u670d\u5668\u65e5\u8a8c\u7684\u6838\u5fc3\u90e8\u5206\u3002\u5927\u591a\u6578\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u4f9b\u61c9\u5546\u4f7f\u7528Apache\u6216Nginx,\u6bcf\u7a2e\u90fd\u6709\u5176\u7368\u7279\u7684\u65e5\u8a8c\u683c\u5f0f\u3002\u4ee5\u4e0b\u662f\u5178\u578b\u7684Nginx\u5b58\u53d6\u65e5\u8a8c\u689d\u76ee\u7684\u5206\u89e3\uff1a<\/p>\n \u9019\u770b\u4f3c\u7c21\u55ae\u7684\u4e00\u884c\u5305\u542b\u95dc\u9375\u8cc7\u8a0a\uff1a<\/p>\n – IP\u4f4d\u5740 (203.0.113.1)<\/p>\n – \u6642\u9593\u6233\u8a18 [10\/Feb\/2025:13:55:36 +0000]<\/p>\n – \u8acb\u6c42\u65b9\u6cd5\u548c\u8def\u5f91 (GET \/api\/v1\/status)<\/p>\n – \u72c0\u614b\u78bc (200)<\/p>\n – \u56de\u61c9\u5927\u5c0f (48\u4f4d\u5143\u7d44)<\/p>\n – \u5f15\u7528\u4f86\u6e90 (https:\/\/example.com)<\/p>\n – \u4f7f\u7528\u8005\u4ee3\u7406\u5b57\u4e32<\/p>\n \u96d6\u7136\u57fa\u672c\u7684\u65e5\u8a8c\u6aa2\u8996\u5668\u80fd\u6eff\u8db3\u57fa\u672c\u9700\u6c42,\u4f46\u9032\u968e\u4f7f\u7528\u8005\u9700\u8981\u66f4\u5f37\u5927\u7684\u5de5\u5177\u3002\u4ee5\u4e0b\u662f\u4f7f\u7528GoAccess(\u4e00\u500b\u5373\u6642\u7d42\u7aef\u65e5\u8a8c\u5206\u6790\u5668)\u7684\u5be6\u7528\u7bc4\u4f8b\uff1a<\/p>\n \u8b93\u6211\u5011\u7de8\u5beb\u4e00\u500bPython\u8173\u672c\u4f86\u8655\u7406\u65e5\u8a8c\u4ee5\u9032\u884c\u9032\u968e\u6a21\u5f0f\u8b58\u5225\u3002\u9019\u500b\u5de5\u5177\u6709\u52a9\u65bc\u8b58\u5225\u6d41\u91cf\u7570\u5e38\u548c\u6f5b\u5728\u7684DDoS\u653b\u64ca\uff1a<\/p>\n \u5728\u5206\u6790\u4f3a\u670d\u5668\u79df\u7528\u6548\u80fd\u6642,\u95dc\u6ce8\u9019\u4e9b\u5f9e\u65e5\u8a8c\u5206\u6790\u4e2d\u5f97\u51fa\u7684\u95dc\u9375\u6307\u6a19\uff1a<\/p>\n \u5be6\u4f5c\u9019\u500bbash\u8173\u672c\u9032\u884c\u5373\u6642\u5b89\u5168\u76e3\u63a7\uff1a<\/p>\n \u57fa\u65bc\u65e5\u8a8c\u5206\u6790\u7d50\u679c,\u9019\u662f\u4e00\u500b\u7d93\u904e\u5be6\u6230\u6aa2\u9a57\u7684Nginx\u8a2d\u5b9a,\u7528\u65bc\u6700\u4f73\u5316\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u6548\u80fd\uff1a<\/p>\n \u9019\u662f\u7528\u65bc\u96c6\u4e2d\u65e5\u8a8c\u7ba1\u7406\u7684\u5be6\u7528ELK Stack\u8a2d\u5b9a\uff1a<\/p>\n \u90e8\u7f72\u9019\u500b\u57fa\u65bc\u6a5f\u5668\u5b78\u7fd2\u7684\u89e3\u6c7a\u65b9\u6848\u4f86\u8b58\u5225\u7570\u5e38\u6d41\u91cf\u6a21\u5f0f\uff1a<\/p>\n \u4f7f\u7528Node.js\u548cWebSocket\u5be6\u4f5c\u9019\u500b\u76e3\u63a7\u5100\u8868\u677f\u8173\u672c\u4ee5\u9032\u884c\u5373\u6642\u66f4\u65b0\uff1a<\/p>\n \u96a8\u8457\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u767c\u5c55,\u8003\u616e\u5728\u65e5\u8a8c\u5206\u6790\u5de5\u4f5c\u6d41\u7a0b\u4e2d\u5be6\u65bd\u9019\u4e9b\u65b0\u8208\u8da8\u52e2\uff1a<\/p>\n - \u7528\u65bc\u5bb9\u91cf\u898f\u5283\u7684AI\u9a45\u52d5\u9810\u6e2c\u5206\u6790<\/p>\n - \u96f6\u4fe1\u4efb\u5b89\u5168\u76e3\u63a7<\/p>\n - \u5bb9\u5668\u611f\u77e5\u65e5\u8a8c\u5f59\u6574<\/p>\n - \u908a\u7de3\u904b\u7b97\u6307\u6a19\u6574\u5408<\/p>\n \u95dc\u6ce8\u9019\u4e9b\u95dc\u9375\u9818\u57df\u4ee5\u9032\u884c\u6709\u6548\u7684\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u65e5\u8a8c\u5206\u6790\uff1a<\/p>\n 1. \u81ea\u52d5\u7570\u5e38\u6aa2\u6e2c<\/p>\n 2. \u5373\u6642\u5b89\u5168\u76e3\u63a7<\/p>\n 3. \u57fa\u65bc\u6d41\u91cf\u6a21\u5f0f\u7684\u6548\u80fd\u6700\u4f73\u5316<\/p>\n 4. \u96c6\u4e2d\u5f0f\u65e5\u8a8c\u7ba1\u7406<\/p>\n 5. \u6a5f\u5668\u5b78\u7fd2\u6574\u5408<\/p>\n \u5728\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u4e2d\u638c\u63e1\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u9700\u8981\u6280\u8853\u5c08\u696d\u77e5\u8b58\u548c\u7b56\u7565\u601d\u7dad\u7684\u7d50\u5408\u3002\u900f\u904e\u5be6\u65bd\u6240\u8a0e\u8ad6\u7684\u5de5\u5177\u548c\u6280\u8853,\u60a8\u5c07\u66f4\u597d\u5730\u8655\u7406\u6d41\u91cf\u5206\u6790\u3001\u5b89\u5168\u76e3\u63a7\u548c\u6548\u80fd\u6700\u4f73\u5316\u3002\u7e7c\u7e8c\u5617\u8a66\u65b0\u7684\u5206\u6790\u65b9\u6cd5,\u4e26\u53ca\u6642\u4e86\u89e3\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u9818\u57df\u7684\u65b0\u8208\u6280\u8853\u3002<\/p>\n","protected":false},"excerpt":{"rendered":" \u70ba\u4ec0\u9ebc\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u5728\u73fe\u4ee3\u4f3a\u670d\u5668\u79df\u7528\u4e2d\u5982\u6b64\u91cd\u8981 \u5728\u7f8e\u570b\u4f3a\u670d\u5668\u79df\u7528\u74b0\u5883\u7684\u52d5\u614b\u683c\u5c40\u4e2d,\u7406\u89e3\u4f3a\u670d\u5668\u65e5\u8a8c\u5206\u6790\u4e0d\u50c5\u50c5\u662f\u76e3 […]<\/p>\n\u7406\u89e3\u65e5\u8a8c\u683c\u5f0f\u548c\u7d50\u69cb<\/strong><\/h2>\n
\r\n203.0.113.1 - - [10\/Feb\/2025:13:55:36 +0000] \"GET \/api\/v1\/status HTTP\/1.1\" 200 48 \"https:\/\/example.com\" \"Mozilla\/5.0\"\r\n<\/code><\/pre>\n\u9032\u968e\u4f7f\u7528\u8005\u5fc5\u5099\u7684\u5206\u6790\u5de5\u5177<\/strong><\/h2>\n
\r\n# \u5373\u6642\u5206\u6790\r\ngoaccess access.log -c --real-time-html > report.html\r\n\r\n# \u751f\u6210\u8a73\u7d30\u7684PDF\u5831\u544a\r\ngoaccess access.log --log-format=COMBINED \\\r\n --date-format=%d\/%b\/%Y \\\r\n --time-format=%H:%M:%S \\\r\n --output=report.pdf\r\n<\/code><\/pre>\n\u9032\u968e\u6d41\u91cf\u6a21\u5f0f\u5206\u6790<\/strong><\/h2>\n
\r\nimport re\r\nfrom collections import defaultdict\r\nfrom datetime import datetime\r\n\r\ndef analyze_traffic_patterns(log_file):\r\n ip_counts = defaultdict(int)\r\n request_timestamps = defaultdict(list)\r\n \r\n pattern = r'(\\d+\\.\\d+\\.\\d+\\.\\d+).*\\[(.+?)\\].*\"(\\w+)\\s+([^\\s]+)'\r\n \r\n with open(log_file, 'r') as f:\r\n for line in f:\r\n match = re.search(pattern, line)\r\n if match:\r\n ip, timestamp, method, path = match.groups()\r\n ip_counts[ip] += 1\r\n \r\n dt = datetime.strptime(timestamp, '%d\/%b\/%Y:%H:%M:%S')\r\n request_timestamps[ip].append(dt)\r\n \r\n # \u6aa2\u6e2c\u5feb\u901f\u8acb\u6c42\u6a21\u5f0f\r\n suspicious_ips = []\r\n for ip, timestamps in request_timestamps.items():\r\n if len(timestamps) > 100: # \u95be\u503c\r\n time_diffs = []\r\n for i in range(1, len(timestamps)):\r\n diff = (timestamps[i] - timestamps[i-1]).total_seconds()\r\n time_diffs.append(diff)\r\n \r\n avg_time_between_requests = sum(time_diffs) \/ len(time_diffs)\r\n if avg_time_between_requests < 0.5: # \u5982\u679c\u5c0f\u65bc0.5\u79d2\u5247\u53ef\u7591\r\n suspicious_ips.append(ip)\r\n \r\n return suspicious_ips\r\n<\/code><\/pre>\n\u91cd\u8981\u7684\u6548\u80fd\u6307\u6a19<\/strong><\/h2>\n
\n
\u900f\u904e\u65e5\u8a8c\u6316\u6398\u9032\u884c\u5b89\u5168\u5206\u6790<\/strong><\/h2>\n
\r\n#!\/bin\/bash\r\n\r\n# \u76e3\u63a7\u53ef\u7591\u7684POST\u8acb\u6c42\r\ntail -f \/var\/log\/nginx\/access.log | \\\r\ngrep --line-buffered \"POST\" | \\\r\nawk '{ if ($6 >= 400) print \"\u4f86\u81eaIP\u7684\u53ef\u7591POST\u8acb\u6c42: \" $1 }'\r\n\r\n# \u8ffd\u8e64\u5931\u6557\u7684\u8a8d\u8b49\u5617\u8a66\r\ntail -f \/var\/log\/auth.log | \\\r\ngrep --line-buffered \"Failed password\" | \\\r\nawk '{ print $11 }' | \\\r\nsort | uniq -c | \\\r\nawk '{ if ($1 > 5) print \"\u53ef\u80fd\u7684\u66b4\u529b\u653b\u64ca\u4f86\u81ea: \" $2 }'\r\n<\/code><\/pre>\n\u5be6\u969b\u6700\u4f73\u5316\u7b56\u7565<\/strong><\/h2>\n
\r\nhttp {\r\n # \u6700\u4f73\u5316\u5de5\u4f5c\u7a0b\u5e8f\u9023\u7d50\r\n worker_processes auto;\r\n worker_connections 2048;\r\n\r\n # \u555f\u7528\u58d3\u7e2e\r\n gzip on;\r\n gzip_comp_level 5;\r\n gzip_types text\/plain text\/css application\/javascript application\/json;\r\n\r\n # \u7de9\u885d\u5340\u5927\u5c0f\u6700\u4f73\u5316\r\n client_body_buffer_size 10K;\r\n client_header_buffer_size 1k;\r\n client_max_body_size 8m;\r\n large_client_header_buffers 2 1k;\r\n\r\n # \u903e\u6642\u8a2d\u5b9a\r\n client_body_timeout 12;\r\n client_header_timeout 12;\r\n keepalive_timeout 15;\r\n send_timeout 10;\r\n\r\n # \u5feb\u53d6\u6700\u4f73\u5316\r\n open_file_cache max=200000 inactive=20s;\r\n open_file_cache_valid 30s;\r\n open_file_cache_min_uses 2;\r\n open_file_cache_errors on;\r\n}\r\n<\/code><\/pre>\n\u81ea\u52d5\u5316\u65e5\u8a8c\u5206\u6790\u6d41\u7a0b<\/strong><\/h2>\n
\r\ninput {\r\n file {\r\n path => \"\/var\/log\/nginx\/access.log\"\r\n start_position => \"beginning\"\r\n type => \"nginx-access\"\r\n codec => json\r\n }\r\n}\r\n\r\nfilter {\r\n if [type] == \"nginx-access\" {\r\n grok {\r\n match => { \"message\" => \"%{COMBINEDAPACHELOG}\" }\r\n }\r\n geoip {\r\n source => \"clientip\"\r\n }\r\n useragent {\r\n source => \"agent\"\r\n }\r\n }\r\n}\r\n\r\noutput {\r\n elasticsearch {\r\n hosts => [\"localhost:9200\"]\r\n index => \"nginx-access-%{+YYYY.MM.dd}\"\r\n }\r\n stdout { codec => rubydebug }\r\n}\r\n<\/code><\/pre>\n\u6d41\u91cf\u7570\u5e38\u6aa2\u6e2c<\/strong><\/h2>\n
\r\nfrom sklearn.ensemble import IsolationForest\r\nimport pandas as pd\r\n\r\ndef detect_anomalies(log_data):\r\n # \u5c07\u65e5\u8a8c\u8cc7\u6599\u8f49\u63db\u70ba\u7279\u5fb5\r\n features = pd.DataFrame({\r\n 'requests_per_minute': log_data['requests_count'],\r\n 'avg_response_time': log_data['response_time'],\r\n 'error_rate': log_data['error_count'] \/ log_data['requests_count']\r\n })\r\n \r\n # \u8a13\u7df4\u9694\u96e2\u68ee\u6797\r\n iso_forest = IsolationForest(\r\n contamination=0.1,\r\n random_state=42\r\n )\r\n \r\n # \u64ec\u5408\u548c\u9810\u6e2c\r\n anomalies = iso_forest.fit_predict(features)\r\n return anomalies == -1 # True\u8868\u793a\u7570\u5e38\r\n<\/code><\/pre>\n\u6301\u7e8c\u76e3\u63a7\u7684\u6700\u4f73\u5be6\u52d9<\/strong><\/h2>\n
\r\nconst WebSocket = require('ws');\r\nconst tail = require('tail').Tail;\r\nconst wss = new WebSocket.Server({ port: 8080 });\r\n\r\n\/\/ \u521d\u59cb\u5316\u65e5\u8a8c\u76e3\u63a7\r\nconst logTail = new tail(\"\/var\/log\/nginx\/access.log\");\r\n\r\n\/\/ \u8ffd\u8e64\u6307\u6a19\r\nlet metrics = {\r\n requestCount: 0,\r\n errorCount: 0,\r\n avgResponseTime: 0,\r\n uniqueIPs: new Set()\r\n};\r\n\r\n\/\/ \u5ee3\u64ad\u66f4\u65b0\r\nfunction broadcastMetrics() {\r\n wss.clients.forEach(client => {\r\n if (client.readyState === WebSocket.OPEN) {\r\n client.send(JSON.stringify(metrics));\r\n }\r\n });\r\n}\r\n\r\n\/\/ \u76e3\u63a7\u65e5\u8a8c\u66f4\u65b0\r\nlogTail.on(\"line\", (data) => {\r\n const logEntry = JSON.parse(data);\r\n metrics.requestCount++;\r\n metrics.uniqueIPs.add(logEntry.ip);\r\n \r\n if (logEntry.status >= 400) {\r\n metrics.errorCount++;\r\n }\r\n \r\n broadcastMetrics();\r\n});\r\n<\/code><\/pre>\n\u672a\u4f86\u5206\u6790\u7b56\u7565\u7684\u898f\u5283<\/strong><\/h2>\n
\u5be6\u7528\u8981\u9ede<\/strong><\/h2>\n
\u7d50\u8ad6<\/strong><\/h2>\n