如何使用 Python 编写简单的入侵检测系统？

import os
import re
import time

log_file = "/var/log/auth.log"  # 监控的日志文件
threshold = 3  # 设定阈值，表示在多长时间内出现多少次异常行为视为入侵

# 定义正则表达式匹配关键字
keywords = ["Failed password", "Failed to authenticate", "Invalid user", "illegal user", "Bad protocol version"]

# 定义记录异常行为的字典，以 IP 地址为键，异常次数及最近一次出现时间为值
abnormal_dict = {}

# 监控循环
while True:
    # 每次读取最后 100 行日志
    lines = os.popen(f"tail -n 100 {log_file}").readlines()

    # 开始监控
    for line in lines:
        for keyword in keywords:
            if re.search(keyword, line):
                ip_address = re.findall(r'\d+.\d+.\d+.\d+', line)[0]  # 提取 IP 地址
                if ip_address in abnormal_dict:
                    if time.time() - abnormal_dict[ip_address]["last_time"] < threshold*60:
                        abnormal_dict[ip_address]["count"] += 1
                        abnormal_dict[ip_address]["last_time"] = time.time()
                        print(f"Intrusion detected! IP: {ip_address}, count: {abnormal_dict[ip_address]['count']}")
                    else:
                        del abnormal_dict[ip_address]
                else:
                    abnormal_dict[ip_address] = {"count": 1, "last_time": time.time()}
    time.sleep(10)  # 每 10 秒检测一次