Add comprehensive threat intelligence and behavioral analysis
Created new threat intelligence library with extensive monitoring capabilities: Threat Intelligence Integration: - AbuseIPDB API integration with caching (24hr TTL) - Geolocation detection via geoiplookup/whois - High-risk country identification - ISP and country-based risk scoring Smart Whitelisting: - Automatic detection of legitimate services (Google, Cloudflare, Microsoft, Akamai) - CDN IP range recognition - Configurable whitelist management Behavioral Analysis: - Request timing pattern analysis (human vs bot detection) - Attack pattern learning and recording - Pattern matching for repeat attackers Performance Monitoring: - Server load tracking integration - Stress detection for adaptive mitigation - CPU and load average monitoring Incident Response: - Automated incident report generation - Comprehensive threat intelligence summaries - Attack history tracking - Recommended action suggestions Multi-Server Coordination: - Shared threat data logging - Cross-server attack correlation preparation Live Monitor Integration: - Auto-enrichment on first IP encounter - AbuseIPDB confidence scoring boost (30pts for 75%+, 15pts for 50%+) - High-risk country detection adds 5pts - Attack pattern recording for learning - New keyboard commands: i) Threat intelligence lookup with incident reports p) Performance impact monitor All features use existing system tools only (no new services installed)
This commit is contained in:
cschantz
@@ -0,0 +1,466 @@
|
||||
#!/bin/bash
|
||||
|
||||
################################################################################
|
||||
# Threat Intelligence Library
|
||||
################################################################################
|
||||
# Purpose: External threat intelligence integration using existing tools
|
||||
# Features: IP reputation lookups, geolocation, whitelist management
|
||||
# No new services - uses only existing APIs and tools
|
||||
################################################################################
|
||||
|
||||
# Cache directory for threat intelligence
|
||||
THREAT_CACHE_DIR="/var/lib/server-toolkit/threat-cache"
|
||||
mkdir -p "$THREAT_CACHE_DIR" 2>/dev/null
|
||||
|
||||
# Cache TTL (24 hours)
|
||||
CACHE_TTL=86400
|
||||
|
||||
################################################################################
|
||||
# AbuseIPDB Integration (Free API - 1000 requests/day)
|
||||
################################################################################
|
||||
|
||||
# Check if IP is in AbuseIPDB
|
||||
# Returns: confidence_score|total_reports|country|isp
|
||||
check_abuseipdb() {
|
||||
local ip="$1"
|
||||
local cache_file="$THREAT_CACHE_DIR/abuseipdb_${ip//\./_}"
|
||||
|
||||
# Check cache first
|
||||
if [ -f "$cache_file" ]; then
|
||||
local cache_age=$(($(date +%s) - $(stat -c %Y "$cache_file" 2>/dev/null || echo 0)))
|
||||
if [ "$cache_age" -lt "$CACHE_TTL" ]; then
|
||||
cat "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check if API key exists
|
||||
local api_key_file="/root/.abuseipdb_api_key"
|
||||
if [ ! -f "$api_key_file" ]; then
|
||||
echo "0|0|Unknown|Unknown"
|
||||
return 1
|
||||
fi
|
||||
|
||||
local api_key=$(cat "$api_key_file")
|
||||
|
||||
# Query AbuseIPDB API
|
||||
local response=$(curl -s -G https://api.abuseipdb.com/api/v2/check \
|
||||
--data-urlencode "ipAddress=$ip" \
|
||||
-d maxAgeInDays=90 \
|
||||
-H "Key: $api_key" \
|
||||
-H "Accept: application/json" 2>/dev/null)
|
||||
|
||||
if [ -n "$response" ]; then
|
||||
local confidence=$(echo "$response" | grep -oP '"abuseConfidenceScore":\K[0-9]+' | head -1)
|
||||
local reports=$(echo "$response" | grep -oP '"totalReports":\K[0-9]+' | head -1)
|
||||
local country=$(echo "$response" | grep -oP '"countryCode":"\K[^"]+' | head -1)
|
||||
local isp=$(echo "$response" | grep -oP '"isp":"\K[^"]+' | head -1)
|
||||
|
||||
local result="${confidence:-0}|${reports:-0}|${country:-Unknown}|${isp:-Unknown}"
|
||||
echo "$result" | tee "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
|
||||
echo "0|0|Unknown|Unknown"
|
||||
return 1
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Geolocation Detection (Using existing geoiplookup or geoip-bin)
|
||||
################################################################################
|
||||
|
||||
# Get country code for IP
|
||||
get_country_code() {
|
||||
local ip="$1"
|
||||
local cache_file="$THREAT_CACHE_DIR/geo_${ip//\./_}"
|
||||
|
||||
# Check cache
|
||||
if [ -f "$cache_file" ]; then
|
||||
local cache_age=$(($(date +%s) - $(stat -c %Y "$cache_file" 2>/dev/null || echo 0)))
|
||||
if [ "$cache_age" -lt "$CACHE_TTL" ]; then
|
||||
cat "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Try geoiplookup (if installed)
|
||||
if command -v geoiplookup &>/dev/null; then
|
||||
local country=$(geoiplookup "$ip" 2>/dev/null | head -1 | grep -oP 'GeoIP Country Edition: \K[A-Z]{2}')
|
||||
if [ -n "$country" ]; then
|
||||
echo "$country" | tee "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Try geoip-bin (alternative)
|
||||
if command -v geoiplookup6 &>/dev/null; then
|
||||
local country=$(geoiplookup6 "$ip" 2>/dev/null | head -1 | grep -oP 'GeoIP Country Edition: \K[A-Z]{2}')
|
||||
if [ -n "$country" ]; then
|
||||
echo "$country" | tee "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Fallback to whois (slower, not cached as aggressively)
|
||||
if command -v whois &>/dev/null; then
|
||||
local country=$(whois "$ip" 2>/dev/null | grep -i "^country:" | head -1 | awk '{print $2}' | tr '[:lower:]' '[:upper:]')
|
||||
if [ -n "$country" ] && [ ${#country} -eq 2 ]; then
|
||||
echo "$country" | tee "$cache_file"
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "XX"
|
||||
return 1
|
||||
}
|
||||
|
||||
# Check if country is high-risk
|
||||
is_high_risk_country() {
|
||||
local country="$1"
|
||||
|
||||
# High-risk countries (commonly seen in attacks)
|
||||
local high_risk="CN RU UA BY KP IR VN TH ID BR"
|
||||
|
||||
if echo "$high_risk" | grep -qw "$country"; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Smart Whitelisting
|
||||
################################################################################
|
||||
|
||||
# Check if IP should be whitelisted (legitimate services)
|
||||
is_whitelisted_service() {
|
||||
local ip="$1"
|
||||
local whitelist_file="/var/lib/server-toolkit/whitelist_ips.txt"
|
||||
|
||||
# Check static whitelist
|
||||
if [ -f "$whitelist_file" ]; then
|
||||
if grep -q "^$ip$" "$whitelist_file"; then
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
|
||||
# Check if IP belongs to known legitimate networks
|
||||
# Google IPs (8.8.0.0/16, 66.249.64.0/19, etc.)
|
||||
if [[ "$ip" =~ ^8\.8\. ]] || [[ "$ip" =~ ^66\.249\. ]] || [[ "$ip" =~ ^66\.102\. ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Cloudflare IPs (173.245.48.0/20, 103.21.244.0/22, etc.)
|
||||
if [[ "$ip" =~ ^173\.245\.(4[8-9]|5[0-9]|6[0-3])\. ]] || [[ "$ip" =~ ^103\.21\.24[4-7]\. ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Microsoft/Bing IPs (40.0.0.0/8, 65.52.0.0/14, etc.)
|
||||
if [[ "$ip" =~ ^40\. ]] || [[ "$ip" =~ ^65\.5[2-5]\. ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
# Common CDN/monitoring services
|
||||
# Akamai: 23.0.0.0/8
|
||||
if [[ "$ip" =~ ^23\. ]]; then
|
||||
return 0
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
# Add IP to whitelist
|
||||
add_to_whitelist() {
|
||||
local ip="$1"
|
||||
local reason="$2"
|
||||
local whitelist_file="/var/lib/server-toolkit/whitelist_ips.txt"
|
||||
|
||||
if ! grep -q "^$ip$" "$whitelist_file" 2>/dev/null; then
|
||||
echo "$ip # $reason" >> "$whitelist_file"
|
||||
fi
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Behavioral Analysis
|
||||
################################################################################
|
||||
|
||||
# Analyze request timing pattern
|
||||
# Returns: human|bot|suspicious
|
||||
analyze_timing_pattern() {
|
||||
local ip="$1"
|
||||
local timing_file="$THREAT_CACHE_DIR/timing_${ip//\./_}"
|
||||
|
||||
# Record timestamp
|
||||
echo "$(date +%s)" >> "$timing_file"
|
||||
|
||||
# Keep only last 100 requests
|
||||
tail -100 "$timing_file" > "${timing_file}.tmp" 2>/dev/null
|
||||
mv "${timing_file}.tmp" "$timing_file" 2>/dev/null
|
||||
|
||||
# Analyze if we have enough data
|
||||
local request_count=$(wc -l < "$timing_file" 2>/dev/null || echo 0)
|
||||
if [ "$request_count" -lt 10 ]; then
|
||||
echo "unknown"
|
||||
return
|
||||
fi
|
||||
|
||||
# Calculate average time between requests
|
||||
local timestamps=$(cat "$timing_file")
|
||||
local total_gap=0
|
||||
local gap_count=0
|
||||
local prev_ts=""
|
||||
|
||||
while IFS= read -r ts; do
|
||||
if [ -n "$prev_ts" ]; then
|
||||
local gap=$((ts - prev_ts))
|
||||
total_gap=$((total_gap + gap))
|
||||
gap_count=$((gap_count + 1))
|
||||
fi
|
||||
prev_ts="$ts"
|
||||
done <<< "$timestamps"
|
||||
|
||||
if [ "$gap_count" -gt 0 ]; then
|
||||
local avg_gap=$((total_gap / gap_count))
|
||||
|
||||
# Bot patterns: < 2 seconds between requests consistently
|
||||
if [ "$avg_gap" -lt 2 ]; then
|
||||
echo "bot"
|
||||
return
|
||||
fi
|
||||
|
||||
# Human patterns: 5-30 seconds between requests with variation
|
||||
if [ "$avg_gap" -ge 5 ] && [ "$avg_gap" -le 30 ]; then
|
||||
echo "human"
|
||||
return
|
||||
fi
|
||||
|
||||
# Suspicious: Too fast but not consistent bot pattern
|
||||
echo "suspicious"
|
||||
return
|
||||
fi
|
||||
|
||||
echo "unknown"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Attack Pattern Learning
|
||||
################################################################################
|
||||
|
||||
# Record attack pattern for learning
|
||||
record_attack_pattern() {
|
||||
local ip="$1"
|
||||
local attack_type="$2"
|
||||
local uri="$3"
|
||||
local user_agent="$4"
|
||||
|
||||
local pattern_file="/var/lib/server-toolkit/attack-patterns/patterns.log"
|
||||
mkdir -p "$(dirname "$pattern_file")" 2>/dev/null
|
||||
|
||||
# Format: timestamp|ip|attack_type|uri|user_agent
|
||||
echo "$(date +%s)|$ip|$attack_type|$uri|$user_agent" >> "$pattern_file"
|
||||
|
||||
# Keep only last 10000 patterns (prevent unbounded growth)
|
||||
tail -10000 "$pattern_file" > "${pattern_file}.tmp" 2>/dev/null
|
||||
mv "${pattern_file}.tmp" "$pattern_file" 2>/dev/null
|
||||
}
|
||||
|
||||
# Check if attack matches known pattern
|
||||
matches_known_pattern() {
|
||||
local attack_type="$1"
|
||||
local uri="$2"
|
||||
|
||||
local pattern_file="/var/lib/server-toolkit/attack-patterns/patterns.log"
|
||||
|
||||
if [ ! -f "$pattern_file" ]; then
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Check if this attack type + similar URI has been seen before
|
||||
local similar_count=$(grep "|$attack_type|" "$pattern_file" | grep -c "$uri" || echo 0)
|
||||
|
||||
if [ "$similar_count" -ge 3 ]; then
|
||||
return 0 # Known pattern
|
||||
fi
|
||||
|
||||
return 1 # New pattern
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Performance Impact Monitoring
|
||||
################################################################################
|
||||
|
||||
# Get current server load
|
||||
get_server_load() {
|
||||
# Returns: load_1min|load_5min|load_15min|cpu_count
|
||||
local load=$(uptime | awk -F'load average:' '{print $2}' | sed 's/,//g' | xargs)
|
||||
local cpu_count=$(nproc)
|
||||
|
||||
echo "${load}|${cpu_count}"
|
||||
}
|
||||
|
||||
# Check if server is under stress
|
||||
is_server_stressed() {
|
||||
local load_data=$(get_server_load)
|
||||
IFS='|' read -r load1 load5 load15 cpu_count <<< "$load_data"
|
||||
|
||||
# Remove any extra spaces
|
||||
load1=$(echo "$load1" | awk '{print $1}')
|
||||
|
||||
# Convert to integer (multiply by 100 to handle decimals)
|
||||
local load_int=$(echo "$load1 * 100" | bc 2>/dev/null | cut -d. -f1)
|
||||
local threshold=$((cpu_count * 80)) # 80% of CPU count
|
||||
|
||||
if [ "$load_int" -gt "$threshold" ]; then
|
||||
return 0 # Server is stressed
|
||||
fi
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Incident Report Generation
|
||||
################################################################################
|
||||
|
||||
# Generate incident report for an IP
|
||||
generate_incident_report() {
|
||||
local ip="$1"
|
||||
local report_file="/var/lib/server-toolkit/incident-reports/report_${ip//\./_}_$(date +%Y%m%d_%H%M%S).txt"
|
||||
|
||||
mkdir -p "$(dirname "$report_file")" 2>/dev/null
|
||||
|
||||
{
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo "SECURITY INCIDENT REPORT"
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo ""
|
||||
echo "Generated: $(date '+%Y-%m-%d %H:%M:%S %Z')"
|
||||
echo "IP Address: $ip"
|
||||
echo ""
|
||||
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
echo "THREAT INTELLIGENCE"
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
|
||||
# AbuseIPDB data
|
||||
local abuse_data=$(check_abuseipdb "$ip")
|
||||
IFS='|' read -r confidence reports country isp <<< "$abuse_data"
|
||||
echo "AbuseIPDB Confidence: ${confidence}%"
|
||||
echo "Total Reports: $reports"
|
||||
echo "Country: $country"
|
||||
echo "ISP: $isp"
|
||||
echo ""
|
||||
|
||||
# Geolocation
|
||||
local geo=$(get_country_code "$ip")
|
||||
echo "Geolocation: $geo"
|
||||
if is_high_risk_country "$geo"; then
|
||||
echo "Risk Level: HIGH (Known attack source country)"
|
||||
else
|
||||
echo "Risk Level: MEDIUM"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
echo "ATTACK HISTORY"
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
|
||||
# Get attacks from pattern log
|
||||
local pattern_file="/var/lib/server-toolkit/attack-patterns/patterns.log"
|
||||
if [ -f "$pattern_file" ]; then
|
||||
echo "Recent attacks from this IP:"
|
||||
grep "|$ip|" "$pattern_file" | tail -20 | while IFS='|' read -r ts ip_addr attack_type uri ua; do
|
||||
echo " [$(date -d @$ts '+%Y-%m-%d %H:%M:%S')] $attack_type - $uri"
|
||||
done
|
||||
echo ""
|
||||
fi
|
||||
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
echo "RECOMMENDED ACTIONS"
|
||||
echo "─────────────────────────────────────────────────────────────"
|
||||
|
||||
if [ "$confidence" -ge 75 ]; then
|
||||
echo "• IMMEDIATE BLOCK - High confidence malicious IP"
|
||||
echo " Command: csf -d $ip \"AbuseIPDB: ${confidence}% confidence\""
|
||||
elif [ "$reports" -ge 10 ]; then
|
||||
echo "• TEMPORARY BLOCK - Multiple abuse reports"
|
||||
echo " Command: csf -td $ip 86400 \"Multiple abuse reports\""
|
||||
else
|
||||
echo "• MONITOR - Watch for continued activity"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
echo "END OF REPORT"
|
||||
echo "═══════════════════════════════════════════════════════════════"
|
||||
|
||||
} > "$report_file"
|
||||
|
||||
echo "$report_file"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Multi-Server Coordination (for environments with multiple servers)
|
||||
################################################################################
|
||||
|
||||
# Share threat data with other servers (if configured)
|
||||
share_threat_data() {
|
||||
local ip="$1"
|
||||
local attack_type="$2"
|
||||
local score="$3"
|
||||
|
||||
local coordination_file="/var/lib/server-toolkit/shared-threats.log"
|
||||
|
||||
# Log for potential sharing
|
||||
echo "$(date +%s)|$(hostname)|$ip|$attack_type|$score" >> "$coordination_file"
|
||||
|
||||
# Keep only last 1000 entries
|
||||
tail -1000 "$coordination_file" > "${coordination_file}.tmp" 2>/dev/null
|
||||
mv "${coordination_file}.tmp" "$coordination_file" 2>/dev/null
|
||||
}
|
||||
|
||||
# Check if IP is flagged by other servers
|
||||
check_shared_threats() {
|
||||
local ip="$1"
|
||||
local coordination_file="/var/lib/server-toolkit/shared-threats.log"
|
||||
|
||||
if [ -f "$coordination_file" ]; then
|
||||
local count=$(grep "|$ip|" "$coordination_file" | wc -l)
|
||||
echo "$count"
|
||||
else
|
||||
echo "0"
|
||||
fi
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Threat Intelligence Summary
|
||||
################################################################################
|
||||
|
||||
# Get comprehensive threat intelligence for an IP
|
||||
get_threat_intelligence() {
|
||||
local ip="$1"
|
||||
|
||||
local abuse_data=$(check_abuseipdb "$ip" 2>/dev/null || echo "0|0|Unknown|Unknown")
|
||||
local geo=$(get_country_code "$ip" 2>/dev/null || echo "XX")
|
||||
local timing=$(analyze_timing_pattern "$ip" 2>/dev/null || echo "unknown")
|
||||
local whitelisted="no"
|
||||
is_whitelisted_service "$ip" && whitelisted="yes"
|
||||
|
||||
# Format: abuse_confidence|abuse_reports|country|isp|timing_pattern|whitelisted
|
||||
echo "${abuse_data}|${geo}|${timing}|${whitelisted}"
|
||||
}
|
||||
|
||||
# Export functions for use in other scripts
|
||||
export -f check_abuseipdb
|
||||
export -f get_country_code
|
||||
export -f is_high_risk_country
|
||||
export -f is_whitelisted_service
|
||||
export -f add_to_whitelist
|
||||
export -f analyze_timing_pattern
|
||||
export -f record_attack_pattern
|
||||
export -f matches_known_pattern
|
||||
export -f get_server_load
|
||||
export -f is_server_stressed
|
||||
export -f generate_incident_report
|
||||
export -f share_threat_data
|
||||
export -f check_shared_threats
|
||||
export -f get_threat_intelligence
|
||||
@@ -21,6 +21,7 @@ source "$SCRIPT_DIR/lib/system-detect.sh"
|
||||
source "$SCRIPT_DIR/lib/ip-reputation.sh"
|
||||
source "$SCRIPT_DIR/lib/bot-signatures.sh"
|
||||
source "$SCRIPT_DIR/lib/attack-patterns.sh"
|
||||
source "$SCRIPT_DIR/lib/threat-intelligence.sh"
|
||||
|
||||
# Require root
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
@@ -158,11 +159,61 @@ update_ip_intelligence() {
|
||||
# Increment hits
|
||||
hits=$((hits + 1))
|
||||
|
||||
# Enrich with threat intelligence on first encounter (hits == 1)
|
||||
if [ $hits -eq 1 ]; then
|
||||
# Check if whitelisted first
|
||||
if is_whitelisted_service "$ip" 2>/dev/null; then
|
||||
score=0
|
||||
bot_type="legit"
|
||||
else
|
||||
# Get threat intelligence (in background to avoid slowing down)
|
||||
(
|
||||
local threat_intel=$(get_threat_intelligence "$ip" 2>/dev/null)
|
||||
IFS='|' read -r abuse_conf abuse_rpts country isp geo timing whitelisted <<< "$threat_intel"
|
||||
|
||||
# Store enrichment data for later use
|
||||
local enrich_file="$TEMP_DIR/threat_enrich_${ip//\./_}"
|
||||
echo "$threat_intel" > "$enrich_file"
|
||||
|
||||
# Boost score based on AbuseIPDB confidence
|
||||
if [ "${abuse_conf:-0}" -ge 75 ]; then
|
||||
# High confidence malicious - add 30 points
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 30))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
elif [ "${abuse_conf:-0}" -ge 50 ]; then
|
||||
# Medium confidence - add 15 points
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 15))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
fi
|
||||
|
||||
# High-risk country adds 5 points
|
||||
if is_high_risk_country "${geo:-XX}" 2>/dev/null; then
|
||||
local current_data="${IP_DATA[$ip]}"
|
||||
IFS='|' read -r old_score old_hits old_bot old_attacks old_ban old_rep <<< "$current_data"
|
||||
local new_score=$((old_score + 5))
|
||||
[ $new_score -gt 100 ] && new_score=100
|
||||
IP_DATA[$ip]="$new_score|$old_hits|$old_bot|$old_attacks|$old_ban|$old_rep"
|
||||
fi
|
||||
) &
|
||||
fi
|
||||
fi
|
||||
|
||||
# Classify bot if unknown
|
||||
if [ "$bot_type" = "unknown" ] && [ -n "$user_agent" ]; then
|
||||
bot_type=$(classify_bot_type "$user_agent")
|
||||
fi
|
||||
|
||||
# Record attack pattern for learning
|
||||
if [ -n "$url" ]; then
|
||||
record_attack_pattern "$ip" "${attacks:-unknown}" "$url" "${user_agent:-unknown}" 2>/dev/null &
|
||||
fi
|
||||
|
||||
# Detect attacks in URL
|
||||
local new_attacks=$(detect_all_attacks "$url" "$method")
|
||||
|
||||
@@ -1254,6 +1305,78 @@ while true; do
|
||||
"$SCRIPT_DIR/modules/security/optimize-ct-limit.sh"
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
i|I)
|
||||
# Show threat intelligence for specific IP
|
||||
clear
|
||||
print_banner "Threat Intelligence Lookup"
|
||||
echo ""
|
||||
read -p "Enter IP address: " lookup_ip
|
||||
if [ -n "$lookup_ip" ]; then
|
||||
echo ""
|
||||
echo "Querying threat intelligence for $lookup_ip..."
|
||||
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
|
||||
local threat_intel=$(get_threat_intelligence "$lookup_ip")
|
||||
IFS='|' read -r abuse_conf abuse_rpts country isp geo timing whitelisted <<< "$threat_intel"
|
||||
echo ""
|
||||
echo "${BOLD}Threat Intelligence:${NC}"
|
||||
echo " AbuseIPDB Confidence: ${abuse_conf}%"
|
||||
echo " Total Abuse Reports: $abuse_rpts"
|
||||
echo " Country: ${geo:-$country}"
|
||||
echo " ISP: $isp"
|
||||
echo " Timing Pattern: $timing"
|
||||
echo " Whitelisted: $whitelisted"
|
||||
echo ""
|
||||
if is_high_risk_country "${geo:-XX}"; then
|
||||
echo -e "${HIGH_COLOR} ⚠️ HIGH RISK COUNTRY${NC}"
|
||||
fi
|
||||
if [ "${abuse_conf:-0}" -ge 75 ]; then
|
||||
echo -e "${CRITICAL_COLOR} 🚨 HIGH CONFIDENCE MALICIOUS${NC}"
|
||||
elif [ "${abuse_conf:-0}" -ge 50 ]; then
|
||||
echo -e "${HIGH_COLOR} ⚠️ MEDIUM CONFIDENCE THREAT${NC}"
|
||||
fi
|
||||
echo ""
|
||||
read -p "Generate full incident report? (y/n): " gen_report
|
||||
if [[ "$gen_report" =~ ^[Yy]$ ]]; then
|
||||
local report_file=$(generate_incident_report "$lookup_ip")
|
||||
echo ""
|
||||
echo "Report generated: $report_file"
|
||||
echo ""
|
||||
echo "View report? (y/n): "
|
||||
read -n 1 view_report
|
||||
if [[ "$view_report" =~ ^[Yy]$ ]]; then
|
||||
less "$report_file"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
p|P)
|
||||
# Show performance impact
|
||||
clear
|
||||
print_banner "Server Performance Monitor"
|
||||
echo ""
|
||||
local load_data=$(get_server_load)
|
||||
IFS='|' read -r load1 load5 load15 cpu_count <<< "$load_data"
|
||||
echo "${BOLD}Current Load:${NC}"
|
||||
echo " 1 min: $load1"
|
||||
echo " 5 min: $load5"
|
||||
echo " 15 min: $load15"
|
||||
echo " CPU cores: $cpu_count"
|
||||
echo ""
|
||||
if is_server_stressed; then
|
||||
echo -e "${CRITICAL_COLOR} 🔥 SERVER UNDER STRESS${NC}"
|
||||
echo ""
|
||||
echo " Recommended Actions:"
|
||||
echo " • Enable aggressive auto-blocking (higher threshold)"
|
||||
echo " • Reduce CT_LIMIT temporarily"
|
||||
echo " • Block high-volume attack IPs immediately"
|
||||
else
|
||||
echo -e "${SAFE_COLOR} ✓ Server load normal${NC}"
|
||||
fi
|
||||
echo ""
|
||||
read -p "Press Enter to return to monitor..."
|
||||
;;
|
||||
q|Q)
|
||||
cleanup
|
||||
;;
|
||||
@@ -1275,6 +1398,8 @@ while true; do
|
||||
echo "Available Commands:"
|
||||
echo " ${BOLD}b${NC} - Open IP blocking menu (batch or individual)"
|
||||
echo " ${BOLD}c${NC} - Run CT_LIMIT optimizer (analyze traffic & recommend limit)"
|
||||
echo " ${BOLD}i${NC} - Threat intelligence lookup (AbuseIPDB, geo, incident reports)"
|
||||
echo " ${BOLD}p${NC} - Show performance impact monitor (server load)"
|
||||
echo " ${BOLD}s${NC} - Show IP reputation database statistics"
|
||||
echo " ${BOLD}r${NC} - Force refresh display"
|
||||
echo " ${BOLD}h${NC} - Show this help screen"
|
||||
@@ -1284,8 +1409,13 @@ while true; do
|
||||
echo " • Real-time bot classification (legit/AI/monitor/suspicious)"
|
||||
echo " • Attack vector detection (SQL, XSS, RCE, etc.)"
|
||||
echo " • Threat scoring (0-100 scale)"
|
||||
echo " • Threat intelligence integration (AbuseIPDB, geolocation)"
|
||||
echo " • Attack pattern learning & behavioral analysis"
|
||||
echo " • Automated incident report generation"
|
||||
echo " • Smart whitelisting (CDNs, search engines)"
|
||||
echo " • IP reputation DB integration"
|
||||
echo " • CSF/iptables temporary bans (1 hour default)"
|
||||
echo " • Auto-mitigation at critical threshold (score ≥80)"
|
||||
echo " • Memory protection (max ${MAX_TRACKED_IPS} IPs tracked)"
|
||||
echo " • Auto-save every 5 minutes + on exit"
|
||||
echo ""
|
||||
|
||||
Reference in New Issue
Block a user