cschantz
c9bfa211c0
Add context-aware scoring (geo, ISP, time-of-day)
Completes the 10th intelligence system:
Context-Aware Scoring:
- Night attacks (2am-5am server time) = +8pts suspicious timing
- High-risk geography (CN, RU, etc) = +5pts
- Residential ISP attacking servers = +10pts suspicious source
(Comcast, Verizon, AT&T, cable/DSL/fiber residential connections)
Integration:
- Integrated into SSH monitoring with other intelligence
- Uses threat enrichment data from AbuseIPDB lookups
- Adds context reasons to CSF block messages
Example enhanced block reason:
"Score=98 Intel:HIGH_VELOCITY:20/hr+BOT_PATTERN+NIGHT_ATTACK:3h+RESIDENTIAL_ISP"
All 10 intelligence systems now operational in SSH monitoring
2025-11-14 16:45:50 -05:00
..
2025-11-10 20:55:33 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00
2025-11-05 19:00:00 -05:00
2025-11-13 23:01:13 -05:00
2025-11-14 16:45:50 -05:00
2025-11-13 16:53:13 -05:00
2025-11-14 15:43:36 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00
2025-11-03 18:21:40 -05:00