wrk泛洪攻击监控脚本

import osimport subprocessimport time
"""检测网络连接情况"""def check_connections():    # 通过 netstat 命令统计与端口80的连接数    netstat_result = subprocess.check_output('netstat -an | grep :80 | wc -l', shell=True)    # 通过 ss 命令统计与端口80的连接数    ss_result = subprocess.check_output('ss -lnt | grep :80 | wc -l', shell=True)    # 计算总连接数    connections = int(netstat_result.strip()) + int(ss_result.strip())    return connections
def check_load():    """检测系统负载情况"""    # 执行 uptime 命令，获取系统负载均衡数据    result = subprocess.check_output('uptime', shell=True)    # 将结果转化为字符串    result_str = result.decode('utf-8')    # 根据空格分割字符串并获取最后三个元素（即负载均衡）    load_avg = result_str.split()[-3:]    # 将负载均衡前面的逗号去掉，并将结果转化为浮点数类型    load_avg_str = load_avg[0].strip(',')    return float(load_avg_str)
def check_logs():    """检测访问日志情况"""    # 查看日志文件，检索恶意IP    result = subprocess.check_output('tail -n 1000 /opt/lampp/logs/access_log | grep ' 404 ' | wc -l', shell=True)    return int(result.strip())
def block_ip(ip):    """使用iptables命令封锁IP"""    # 将IP通过防火墙加入黑名单    os.system('iptables -I INPUT -s {} -j DROP'.format(ip))    print('IP {} blocked.'.format(ip))
def main():    # 泛红攻击检测阈值    MAX_CONNECTIONS = 500    MAX_LOAD = 2.0    MAX_LOGS = 100
    # 等待wrk工具启动    time.sleep(5)
    # 循环检测泛红攻击    while True:        connections = check_connections()        load = check_load()        logs = check_logs()
        print('Connections: {}, Load: {}, Logs: {}'.format(connections, load, logs))
        if connections > MAX_CONNECTIONS or load > MAX_LOAD or logs > MAX_LOGS:            # 监测到泛红攻击，封锁IP            ip = subprocess.check_output('netstat -an | grep :80 | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr | head -n 1 | awk '{print $2}'', shell=True)            block_ip(ip.strip())            break
        time.sleep(5)
if __name__ == '__main__':    main()