Mini-project
Cybersecurity & Digital Trust
Login log auditor
Read server login logs, find brute-force attempts and list the most suspicious IP addresses.
The brief
A small company's server is attacked every night, but nobody reads the logs. Parse SSH login logs, find brute-force attempts and password-spraying patterns, and list the most suspicious IP addresses with the evidence. Good looks like: a robust parser, clear detection rules, and a daily report an administrator can act on.
What you will build
- Parse SSH authentication logs into events
- Count failures by IP, user and time window
- Write rules for brute force and password spraying
- Rank suspicious IPs with the evidence
- Produce a daily security report
Free, open data to build it with
- Loghub: system log datasets (OpenSSH logs) ↗ LogPAI (GitHub)
Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.