セキュアなログ設計と侵入検知入門！初心者でもわかるセキュリティログの基礎

import datetime

# タイムスタンプの記録例
timestamp = datetime.datetime.now().isoformat()
log_entry = f"{timestamp} - User login attempt"

# アクセス元情報の記録例
def log_access(request):
    ip_address = request.remote_addr
    user_agent = request.headers.get('User-Agent')
    log_entry = f"{timestamp} - IP: {ip_address}, UA: {user_agent}"
    return log_entry

# 悪い例: パスワードをログに記録
def bad_login_log(username, password):
    log = f"Login attempt: {username}, password: {password}"  # NG!
    
# 良い例: パスワードは記録しない
def good_login_log(username, success):
    log = f"Login attempt: {username}, success: {success}"  # OK

# ログファイルの権限設定例（Linux/Unix）
chmod 640 /var/log/security.log
chown root:adm /var/log/security.log

# Pythonでのログローテーション設定例
import logging
from logging.handlers import RotatingFileHandler

# 10MBごとにローテーション、最大5世代保持
handler = RotatingFileHandler(
    'security.log',
    maxBytes=10*1024*1024,
    backupCount=5
)

logger = logging.getLogger('security')
logger.addHandler(handler)

import json
import logging

# JSON形式でのログ記録例
def log_security_event(event_type, user, ip_address, success):
    log_data = {
        "timestamp": datetime.datetime.now().isoformat(),
        "event_type": event_type,
        "user": user,
        "ip_address": ip_address,
        "success": success,
        "severity": "INFO" if success else "WARNING"
    }
    logging.info(json.dumps(log_data))

# 使用例
log_security_event("login", "user123", "192.168.1.100", True)

# シグネチャベース検知の簡単な例
known_attack_patterns = [
    r"(\.\./)+",  # ディレクトリトラバーサル
    r"<script>",  # XSS攻撃
    r"(union|select).*from",  # SQLインジェクション
]

import re

def check_for_attacks(user_input):
    for pattern in known_attack_patterns:
        if re.search(pattern, user_input, re.IGNORECASE):
            return True, f"Attack pattern detected: {pattern}"
    return False, "No threat detected"

# テスト
result, message = check_for_attacks("../../../etc/passwd")
print(message)  # Attack pattern detected

# 異常検知の簡単な例
class AnomalyDetector:
    def __init__(self):
        self.baseline_login_count = 0
        
    def learn_baseline(self, login_counts):
        # 通常時のログイン回数の平均を学習
        self.baseline_login_count = sum(login_counts) / len(login_counts)
        
    def detect_anomaly(self, current_login_count):
        # 通常の3倍以上のログイン試行は異常と判断
        threshold = self.baseline_login_count * 3
        if current_login_count > threshold:
            return True, f"Anomaly detected: {current_login_count} logins (baseline: {self.baseline_login_count})"
        return False, "Normal activity"

# 使用例
detector = AnomalyDetector()
detector.learn_baseline([10, 12, 11, 13, 9])  # 通常時のログイン回数
is_anomaly, message = detector.detect_anomaly(50)  # 異常に多いログイン試行
print(message)

import matplotlib.pyplot as plt
from datetime import datetime, timedelta
import random

# サンプルデータの生成
def generate_sample_logs(days=7):
    logs = {
        'dates': [],
        'login_attempts': [],
        'failed_logins': [],
        'attack_detections': []
    }
    
    start_date = datetime.now() - timedelta(days=days)
    for i in range(days):
        date = start_date + timedelta(days=i)
        logs['dates'].append(date.strftime('%Y-%m-%d'))
        logs['login_attempts'].append(random.randint(100, 200))
        logs['failed_logins'].append(random.randint(5, 30))
        logs['attack_detections'].append(random.randint(0, 10))
    
    return logs

# グラフの作成
logs = generate_sample_logs()

fig, (ax1, ax2) = plt.subplots(2, 1, figsize=(10, 8))

# ログイン試行のグラフ
ax1.plot(logs['dates'], logs['login_attempts'], label='Total Login Attempts', marker='o')
ax1.plot(logs['dates'], logs['failed_logins'], label='Failed Logins', marker='x')
ax1.set_title('Login Activity Over Time')
ax1.set_xlabel('Date')
ax1.set_ylabel('Count')
ax1.legend()
ax1.grid(True)

# 攻撃検知のグラフ
ax2.bar(logs['dates'], logs['attack_detections'], color='red', alpha=0.7)
ax2.set_title('Attack Detections Over Time')
ax2.set_xlabel('Date')
ax2.set_ylabel('Number of Attacks')
ax2.grid(True)

plt.tight_layout()
plt.savefig('security_dashboard.png')
print("Dashboard saved as security_dashboard.png")

class SecurityMonitor:
    def __init__(self):
        self.alert_thresholds = {
            'failed_login': 5,  # 5分間に5回以上
            'attack_detection': 1,  # 1回でも検知したらアラート
            'unusual_traffic': 1000,  # 1分間に1000リクエスト以上
        }
        
    def check_and_alert(self, metric_name, current_value):
        threshold = self.alert_thresholds.get(metric_name)
        if threshold and current_value >= threshold:
            self.send_alert(metric_name, current_value)
            
    def send_alert(self, metric_name, value):
        # 実際にはメールやSlackなどに通知
        print(f"🚨 SECURITY ALERT: {metric_name} exceeded threshold. Current value: {value}")

# 使用例
monitor = SecurityMonitor()
monitor.check_and_alert('failed_login', 7)  # アラート発生