A comprehensive Python-based security analysis tool for web server logs that identifies attack patterns, security threats, and generates professional visual graphs for data analysis.
- Python 3.6+ - Download from python.org
- Operating System: Windows, macOS, or Linux
- Terminal/Command Prompt access
Built-in modules (included with Python):
re- Regular expressions for log parsingdatetime- Timestamp generationos- Directory management
External packages (auto-installed):
matplotlib- Graph generation and visualisationseaborn- Enhanced statistical plotting
Note: External packages are automatically installed when you run the script for the first time.
ieuk-task-2025/
├── logger.py # Main analysis script
├── sample-log.log # Sample web server log file
├── security_analysis_graphs/ # Generated visual graphs folder
├── Report.md # Detailed analysis report and findings
└── README.md # This file
- Visit python.org
- Download Python 3.6 or newer
- Run the installer and ensure "Add Python to PATH" is checked
- Verify installation by opening terminal and typing:
python --version
- Clone or download this repository to your local machine
- Extract to a folder (e.g.,
C:\ieuk-task-2025or/home/user/ieuk-task-2025)
cd /path/to/ieuk-task-2025
python logger.pyExpected Output:
- Console analysis of security threats and attack patterns
- Automatic creation of
security_analysis_graphs/folder - 6 PNG graph files with security visualisations
Navigate to the security_analysis_graphs/ folder to view:
- Status code distribution pie chart
- Top attacked paths analysis
- Geographic attack source mapping
- IP address threat analysis
- Access pattern visualisations
Expected Output: The script generates 6 visual graphs:
status_code_distribution_*.png- Pie chart of security threatstop_attacked_paths_*.png- Bar chart of most targeted endpointsattack_source_countries_*.png- Geographic threat analysiscountry_status_heatmap_*.png- Attack patterns by country and statustop_malicious_ips_*.png- Most active threatening IP addressestop_accessed_paths_*.png- Overall site traffic patterns
- 401 Unauthorized: Failed login attempts and brute force attacks
- 403 Forbidden: Path traversal and unauthorized access attempts
- 404 Not Found: Missing resources and reconnaissance scanning
- 500 Internal Server Error: Application errors and stability issues
- Country-based request patterns
- Identification of hostile nation-state attacks
- Legitimate vs malicious traffic distribution
- Top attacking IP addresses
- Botnet identification
- Attack coordination patterns
- Most accessed legitimate content
- Popular endpoints and resources
- Overall site usage statistics
- Professional Visualisations: Six different graph types for comprehensive analysis
- Automated Threat Detection: Identifies coordinated attacks and security threats
- Interactive Visual Analysis: High-resolution PNG graphs for presentations
- Threat Level Classification: CRITICAL, HIGH, MEDIUM, LOW risk assessment
- Geographic Attribution: Maps attacks to source countries
- Pattern Recognition: Detects brute force, path traversal, and reconnaissance attacks
- Executive Reporting: Summary statistics for management briefings
The terminal displays detailed analysis including:
==================================================
ANALYSIS FOR STATUS CODE 401
==================================================
Top 10 paths with 401 status:
/admin/login?username=admin&password=qwerty: 5 occurrences
...
Countries/locations of 401 requests:
RU: 1387 requests
KP: 1322 requests
...
401 Summary:
Total 401 requests: 5338
Unique paths affected: 1517
Countries involved: 4
Unique IP addresses: 5
You can modify logger.py to:
- Change result limits: Modify numbers in graph generation (e.g.,
[:15]for top 15 results) - Add status codes: Extend
status_codes = ['401', '403', '404', '500']array - Different log files: Change
"sample-log.log"to your log file path - Custom threat levels: Modify threat level assignments
- Graph styling: Modify colours, sizes, and chart types in the plotting sections
All graphs are saved in the security_analysis_graphs/ folder with timestamp naming:
status_code_distribution_*.png: Pie chart showing distribution of security threatstop_attacked_paths_*.png: Bar chart of most frequently attacked endpointsattack_source_countries_*.png: Horizontal bar chart of attack origins by countrycountry_status_heatmap_*.png: Heatmap showing attack patterns by country and status codetop_malicious_ips_*.png: Bar chart of most active malicious IP addressestop_accessed_paths_*.png: Bar chart of most popular legitimate content
- Format: High-resolution PNG (300 DPI)
- Size: Optimised for presentations and reports
- Timestamping: All files include creation timestamp for version control
- Professional Quality: Ready for executive presentations and security reports
"python is not recognized"
- Ensure Python is installed and added to system PATH
- Try using
python3instead ofpythonon macOS/Linux
"No such file or directory: sample-log.log"
- Ensure the log file is in the same directory as
logger.py - Check the file path in the script matches your log file location
"ModuleNotFoundError: matplotlib"
- The script automatically installs required packages
- If manual installation needed:
pip install matplotlib seaborn
"Permission denied"
- Ensure you have write permissions in the directory
- Run terminal as administrator (Windows) or use
sudo(macOS/Linux)
- Check the detailed analysis in
Report.md - Review the generated graph files for visual validation
- Ensure log file format matches the expected pattern
For detailed findings, security recommendations, and implementation guidance, see Report.md.