Python 数据分析在入侵检测中的应用：如何分析安全日志和网络流量数据？

# 导入模块
import re
from datetime import datetime, timedelta

# 定义正则表达式
pattern = r'(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}) - - \[(.*?)\] "(.*?)" (\d{3}) (\d+)'

# 定义时间格式
time_format = '%d/%b/%Y:%H:%M:%S %z'

# 打开日志文件
with open('access.log') as f:
    for line in f:
        # 提取字段
        match = re.match(pattern, line)
        if match:
            ip_address = match.group(1)
            time_str = match.group(2)
            request = match.group(3)
            status_code = match.group(4)
            size = match.group(5)

            # 转换时间格式
            time = datetime.strptime(time_str, time_format)

            # 输出结果
            print(ip_address, time, request, status_code, size)

# 导入模块
import dpkt

# 打开pcap文件
with open('traffic.pcap', 'rb') as f:
    pcap = dpkt.pcap.Reader(f)

    for ts, buf in pcap:
        try:
            # 解析IP包
            eth = dpkt.ethernet.Ethernet(buf)
            ip = eth.data

            # 只处理TCP流量
            if isinstance(ip.data, dpkt.tcp.TCP):

                # 提取字段
                src_ip = socket.inet_ntoa(ip.src)
                dst_ip = socket.inet_ntoa(ip.dst)
                src_port = ip.data.sport
                dst_port = ip.data.dport

                # 输出结果
                print(src_ip, src_port, dst_ip, dst_port)

        except:
            pass