Add comprehensive threat intelligence and behavioral analysis
Created new threat intelligence library with extensive monitoring capabilities: Threat Intelligence Integration: - AbuseIPDB API integration with caching (24hr TTL) - Geolocation detection via geoiplookup/whois - High-risk country identification - ISP and country-based risk scoring Smart Whitelisting: - Automatic detection of legitimate services (Google, Cloudflare, Microsoft, Akamai) - CDN IP range recognition - Configurable whitelist management Behavioral Analysis: - Request timing pattern analysis (human vs bot detection) - Attack pattern learning and recording - Pattern matching for repeat attackers Performance Monitoring: - Server load tracking integration - Stress detection for adaptive mitigation - CPU and load average monitoring Incident Response: - Automated incident report generation - Comprehensive threat intelligence summaries - Attack history tracking - Recommended action suggestions Multi-Server Coordination: - Shared threat data logging - Cross-server attack correlation preparation Live Monitor Integration: - Auto-enrichment on first IP encounter - AbuseIPDB confidence scoring boost (30pts for 75%+, 15pts for 50%+) - High-risk country detection adds 5pts - Attack pattern recording for learning - New keyboard commands: i) Threat intelligence lookup with incident reports p) Performance impact monitor All features use existing system tools only (no new services installed)
This commit is contained in:
cschantz
@@ -21,6 +21,7 @@ source "$SCRIPT_DIR/lib/system-detect.sh"
|
||||
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||
source "$SCRIPT_DIR/lib/bot-signatures.sh"
|
||||
source "$SCRIPT_DIR/lib/attack-patterns.sh"
|
||||
source "$SCRIPT_DIR/lib/threat-intelligence.sh"
|
||||
|
||||
# Require root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
@@ -158,11 +159,61 @@ update_ip_intelligence() {
|
||||
# Increment hits
|
||||
hits=$((hits + 1))
|
||||
|
||||
# Enrich with threat intelligence on first encounter (hits == 1)
|
||||
if [ $hits -eq 1 ]; then
|
||||
# Check if whitelisted first
|
||||
if is_whitelisted_service "$ip" 2>/dev/null; then
|
||||
score=0
|
||||
bot_type="legit"
|
||||
else
|
||||
# Get threat intelligence (in background to avoid slowing down)
|
||||
(
|
||||
local threat_intel=$(get_threat_intelligence "$ip" 2>/dev/null)
|
||||
IFS='|' read -r abuse_conf abuse_rpts country isp geo timing whitelisted <<< "$threat_intel"
|
||||
|
||||
# Store enrichment data for later use
|
||||
local enrich_file="$TEMP_DIR/threat_enrich_${ip//\./_}"
|
||||
echo "$threat_intel" > "$enrich_file"
|
||||
|
||||
# Boost score based on AbuseIPDB confidence
|
||||
if [ "${abuse_conf:-0}" -ge 75 ]; then
|
||||
# High confidence malicious - add 30 points
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 30))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
elif [ "${abuse_conf:-0}" -ge 50 ]; then
|
||||
# Medium confidence - add 15 points
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 15))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
fi
|
||||
|
||||
# High-risk country adds 5 points
|
||||
if is_high_risk_country "${geo:-XX}" 2>/dev/null; then
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 5))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
fi
|
||||
) &
|
||||
fi
|
||||
fi
|
||||
|
||||
# Classify bot if unknown
|
||||
if [ "$bot_type" = "unknown" ] && [ -n "$user_agent" ]; then
|
||||
bot_type=$(classify_bot_type "$user_agent")
|
||||
fi
|
||||
|
||||
# Record attack pattern for learning
|
||||
if [ -n "$url" ]; then
|
||||
record_attack_pattern "$ip" "${attacks:-unknown}" "$url" "${user_agent:-unknown}" 2>/dev/null &
|
||||
fi
|
||||
|
||||
# Detect attacks in URL
|
||||
local new_attacks=$(detect_all_attacks "$url" "$method")
|
||||
|
||||
@@ -1254,6 +1305,78 @@ while true; do
|
||||
"$SCRIPT_DIR/modules/security/optimize-ct-limit.sh"
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
i|I)
|
||||
# Show threat intelligence for specific IP
|
||||
clear
|
||||
print_banner "Threat Intelligence Lookup"
|
||||
echo ""
|
||||
read -p "Enter IP address: " lookup_ip
|
||||
if [ -n "$lookup_ip" ]; then
|
||||
echo ""
|
||||
echo "Querying threat intelligence for $lookup_ip..."
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
local threat_intel=$(get_threat_intelligence "$lookup_ip")
|
||||
IFS='|' read -r abuse_conf abuse_rpts country isp geo timing whitelisted <<< "$threat_intel"
|
||||
echo ""
|
||||
echo "${BOLD}Threat Intelligence:${NC}"
|
||||
echo " AbuseIPDB Confidence: ${abuse_conf}%"
|
||||
echo " Total Abuse Reports: $abuse_rpts"
|
||||
echo " Country: ${geo:-$country}"
|
||||
echo " ISP: $isp"
|
||||
echo " Timing Pattern: $timing"
|
||||
echo " Whitelisted: $whitelisted"
|
||||
echo ""
|
||||
if is_high_risk_country "${geo:-XX}"; then
|
||||
echo -e "${HIGH_COLOR} ⚠️ HIGH RISK COUNTRY${NC}"
|
||||
fi
|
||||
if [ "${abuse_conf:-0}" -ge 75 ]; then
|
||||
echo -e "${CRITICAL_COLOR} 🚨 HIGH CONFIDENCE MALICIOUS${NC}"
|
||||
elif [ "${abuse_conf:-0}" -ge 50 ]; then
|
||||
echo -e "${HIGH_COLOR} ⚠️ MEDIUM CONFIDENCE THREAT${NC}"
|
||||
fi
|
||||
echo ""
|
||||
read -p "Generate full incident report? (y/n): " gen_report
|
||||
if [[ "$gen_report" =~ ^[Yy]$ ]]; then
|
||||
local report_file=$(generate_incident_report "$lookup_ip")
|
||||
echo ""
|
||||
echo "Report generated: $report_file"
|
||||
echo ""
|
||||
echo "View report? (y/n): "
|
||||
read -n 1 view_report
|
||||
if [[ "$view_report" =~ ^[Yy]$ ]]; then
|
||||
less "$report_file"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
p|P)
|
||||
# Show performance impact
|
||||
clear
|
||||
print_banner "Server Performance Monitor"
|
||||
echo ""
|
||||
local load_data=$(get_server_load)
|
||||
IFS='|' read -r load1 load5 load15 cpu_count <<< "$load_data"
|
||||
echo "${BOLD}Current Load:${NC}"
|
||||
echo " 1 min: $load1"
|
||||
echo " 5 min: $load5"
|
||||
echo " 15 min: $load15"
|
||||
echo " CPU cores: $cpu_count"
|
||||
echo ""
|
||||
if is_server_stressed; then
|
||||
echo -e "${CRITICAL_COLOR} 🔥 SERVER UNDER STRESS${NC}"
|
||||
echo ""
|
||||
echo " Recommended Actions:"
|
||||
echo " • Enable aggressive auto-blocking (higher threshold)"
|
||||
echo " • Reduce CT_LIMIT temporarily"
|
||||
echo " • Block high-volume attack IPs immediately"
|
||||
else
|
||||
echo -e "${SAFE_COLOR} ✓ Server load normal${NC}"
|
||||
fi
|
||||
echo ""
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
q|Q)
|
||||
cleanup
|
||||
;;
|
||||
@@ -1275,6 +1398,8 @@ while true; do
|
||||
echo "Available Commands:"
|
||||
echo " ${BOLD}b${NC} - Open IP blocking menu (batch or individual)"
|
||||
echo " ${BOLD}c${NC} - Run CT_LIMIT optimizer (analyze traffic & recommend limit)"
|
||||
echo " ${BOLD}i${NC} - Threat intelligence lookup (AbuseIPDB, geo, incident reports)"
|
||||
echo " ${BOLD}p${NC} - Show performance impact monitor (server load)"
|
||||
echo " ${BOLD}s${NC} - Show IP reputation database statistics"
|
||||
echo " ${BOLD}r${NC} - Force refresh display"
|
||||
echo " ${BOLD}h${NC} - Show this help screen"
|
||||
@@ -1284,8 +1409,13 @@ while true; do
|
||||
echo " • Real-time bot classification (legit/AI/monitor/suspicious)"
|
||||
echo " • Attack vector detection (SQL, XSS, RCE, etc.)"
|
||||
echo " • Threat scoring (0-100 scale)"
|
||||
echo " • Threat intelligence integration (AbuseIPDB, geolocation)"
|
||||
echo " • Attack pattern learning & behavioral analysis"
|
||||
echo " • Automated incident report generation"
|
||||
echo " • Smart whitelisting (CDNs, search engines)"
|
||||
echo " • IP reputation DB integration"
|
||||
echo " • CSF/iptables temporary bans (1 hour default)"
|
||||
echo " • Auto-mitigation at critical threshold (score ≥80)"
|
||||
echo " • Memory protection (max ${MAX_TRACKED_IPS} IPs tracked)"
|
||||
echo " • Auto-save every 5 minutes + on exit"
|
||||
echo ""
|
||||
|
||||
Reference in New Issue
Block a user