对个人博客进行攻击统计后，我发现

'''


Author: AugustTheodor


Date: 2021-12-08 14:37:53


LastEditors: AugustTheodor


LastEditTime: 2021-12-08 16:34:49


Description: Apache网站日志的扫描脚本，用于统计恶意攻击的


'''


import re


re_ip=r"((2[0-4]d|25[0-5]|[01]?dd?).){3}(2[0-4]d|25[0-5]|[01]?dd?)" 


re_url=r"".*?""


def travel(dict,f):


    for i in dict:


        if(i[1]>1): #过滤只访问了一次的ip/url


            f.write(str(i[0])+" => "+str(i[1])+"n")


    f.write("n")


class WebsiteLog:


    dict200={}


    dict4XX={}


    dicturl={}


    def __init__(self,string):


        try:


            self.ip=re.search(re_ip,string).group()


        except:


            self.ip="anonymous"


        self.url=re.search(re_url,string).group()


        #=begin


        self=self.url.replace("HTTP/1.1","")


        self=self.url.replace("HTTP/1.0","")


        self=self.url.replace("GET","")


        self=self.url.replace("POST","") #删这几个差不多了，要加直接在下面加（PUT DELETE这种不建议删除）


        #=end


        self.status=int(string.split('"')[-1].split()[0])


        if self.status==200:


            if not self.ip in WebsiteLog.dict200.keys():


                WebsiteLog.dict200[self.ip]=1


            else:


                WebsiteLog.dict200[self.ip]+=1


        if self.status>400 and self.status<499 and self.status!=408: #去掉408，这个是网络错误


            if not self.ip in WebsiteLog.dict4XX.keys():


                WebsiteLog.dict4XX[self.ip]=1


            else:


                WebsiteLog.dict4XX[self.ip]+=1


            if not self.url in WebsiteLog.dicturl.keys():


                WebsiteLog.dicturl[self.url]=1


            else:


                WebsiteLog.dicturl[self.url]+=1


out=open("output.log","w")


outlist=[]


with open("access.log","r") as f:


    line=f.readlines()


    for i in line:


        outlist.append(WebsiteLog(i))


    WebsiteLog.dict200=sorted(WebsiteLog.dict200.items(), key = lambda kv:(kv[1], kv[0]))


    WebsiteLog.dict4XX=sorted(WebsiteLog.dict4XX.items(), key = lambda kv:(kv[1], kv[0]))


    WebsiteLog.dicturl=sorted(WebsiteLog.dicturl.items(), key = lambda kv:(kv[1], kv[0])) 


    #为什么不写个函数重用呢 因为我懒


    out.write("检查结果如下：n")


    out.write("网站的200访问ip排名如下：n")


    travel(WebsiteLog.dict200,out)


    out.write("网站的异常访问ip排名如下：n")


    travel(WebsiteLog.dict4XX,out)


    out.write("网站的异常访问url排名如下：n")


    travel(WebsiteLog.dicturl,out)


    print("检查完毕！") #可视化是不可能了，只能导出一份报告自己慢慢看的样子