cschantz
f6f3aaee0c
Implement progressive cumulative scoring for bruteforce attacks
Changed from fixed scoring to progressive accumulation that tracks repeated attempts:
Bruteforce Scoring (SSH, Email, FTP):
- First attempt: 10 points
- Each additional: +8 points
- Reaches auto-block threshold (80pts) after 10 attempts
Database Attack Scoring:
- First SQL_INJECTION: +15 points
- Each additional: +12 points
Key Benefits:
- IP reputation grows with each attack attempt
- 18 SSH bruteforce attempts now = 82+ points (auto-blocked at 10th)
- Cumulative across all attack types (SSH + Email + FTP = combined score)
- More aggressive response to persistent attackers
- Aligns with user expectation: more attempts = higher threat score
Example: 8 SSH attempts = 66 points (was 10 before)
Auto-block triggers at 10 attempts instead of never blocking
2025-11-14 16:34:48 -05:00
..
2025-11-06 22:27:47 -05:00
2025-11-03 18:21:40 -05:00
2025-11-05 18:55:16 -05:00
2025-11-03 18:21:40 -05:00
2025-11-14 16:34:48 -05:00
2025-11-10 20:41:13 -05:00