python查找每个ip每天的攻击次数

嘿，我试图找到每个 ip 每天记录的许多攻击。我正在读取系统日志文件。

这里有几行正在阅读

引用...

Jan 10 09:32:09 j4-be03 sshd[3876]: Failed password for root from 218.241.173.35 port 47084 ssh2 
Jan 10 09:32:19 j4-be03 sshd[3879]: Failed password for root from 218.241.173.35 port 47901 ssh2 
Feb 7 17:19:16 j4-be03 sshd[10736]: Failed password for root from 89.249.209.92 port 46139 ssh2  

这是我的代码:

desc_date = {}      
count_date = 0 
desc_ip = {} 
count_ip = 0 
 
for line in myfile: 
    if 'Failed password for' in line:      
        line_of_list = line.split()      
        #working together 
        date_port = ' '.join(line_of_list[0:2]) 
        date_list = date_port.split(':') 
        date = date_list[0] 
        if desc_date.has_key(date): 
            count_date = desc_date[date] 
            count_date = count_date +1 
            desc_date[date] = count_date 
            #zero out the temporary counter as a precaution 
            count_date =0 
        else: 
            desc_date[date] = 1 
 
        ip_port = line_of_list[-4] 
        ip_list = ip_port.split(':') 
        ip_address = ip_list[0] 
        if desc_ip.has_key(ip_address): 
            count_ip = desc_ip[ip_address] 
            count_ip = count_ip +1 
            desc_ip[ip_address] = count_ip 
            #zero out the temporary counter as a precaution 
            count_ip =0 
        else: 
            desc_ip[ip_address] = 1 
 
        resulting = dict(desc_date.items() + desc_ip.items()) 
        for result in resulting: 
            print result,' has', resulting[result] , ' attacks' 

目前给我这些错误的结果:

引用...

Feb 8 has 33 attacks 
218.241.173.35 has 15 attacks 
72.153.93.203 has 14 attacks 
213.251.192.26 has 13 attacks 
66.30.90.148 has 14 attacks 
Feb 7 has 15 attacks 
92.152.92.123 has 5 attacks 
Jan 10 has 28 attacks 
89.249.209.92 has 15 attacks  

哪个ip地址是错误的，不确定代码哪里出了问题希望有人能帮忙

请您参考如下方法:

试试这个解决方案，我用问题中的样本输入测试了它并且工作正常:

import re 
from collections import defaultdict 
pattern = re.compile(r'(\w{3}\s+\d{1,2}).+Failed password for .+? from (\S+)') 
 
def attack_dict(myfile): 
    attacks = defaultdict(lambda: defaultdict(int)) 
    for line in myfile: 
        found = pattern.match(line) 
        if found: 
            date, ip = found.groups() 
            attacks[date][ip] += 1 
    return attacks 
 
def report(myfile): 
    for date, ips in attack_dict(myfile).iteritems(): 
        print '{0} has {1} attacks'.format(date, sum(ips.itervalues())) 
        for ip, n in ips.iteritems(): 
            print '\t{0} has {1} attacks'.format(ip, n) 

像这样运行它:

report(myfile) # myfile is the opened file with the log