← ACARA Digital Technologies Years 9–10

Spotting an attack in a log file

Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 91, WA Computer Science ATAR Year 11 — Network Communications — Module 133, WA Computer Science ATAR Year 11 — Cyber Security — Module 113

Understanding Spotting an attack in a log file in ACARA Digital Technologies Years 9–10

What it does: The times run in order, so the failures clearly happen before the success and show how the attack unfolded. Comparing the time of a login with the user's normal hours reveals activity that does not fit their usual pattern. Many failures in a short time followed by one success is a classic sign that an attacker kept guessing until they got in. A login from an unusual place, especially so soon after a normal one, can mean someone else has the password. A correct password does not prove who typed it. Look at what came before and where and when the login happened.

Common mistakes: The program counts failed logins, so it must check for 'FAIL'. Checking for 'OK' counts successful logins and would miss a run of failed attempts. An attack shows up as many failed logins, so the check should be fails >= 5. Using <= 5 would flag few failures and ignore a large number.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Spotting an attack in a log file to a class →

This module's key terms are also in a printable crossword (Modules 828–859) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A log shows 40 failed logins for one account in two minutes, then one success. What does this pattern most likely suggest?
A user who simply had a normal busy morningA brute-force attack that finally guessed the password
Matches
Log: 10:00 FAIL ava, 10:01 FAIL ava, 10:02 FAIL ava Conclusion: nothing unusual, ignore it.
↓
Three failed logins in a row for one account is a pattern, not nothing. Ignoring repeated failures can miss a brute-force attack.
Applying
Meanings
Term
log analysis
Meaning
Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.
Practice
02:14:05 FAIL user=ava ip=203.0.113.9
Testing
Gaps
= failCount + 1
Check Answer
Spots
2for entry in log:
3 if entry == 'OK':

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Lion's Mane Jellyfish' badge — Set Operator, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A log shows 40 failed logins for one account in two minutes, then one success. What does this pattern most likely suggest?
A. A user who simply had a normal busy morning
B. A brute-force attack that finally guessed the password ✓
Many failures in a short time followed by one success is a classic sign that an attacker kept guessing until they got in.
2. Which log entry is the strongest warning sign?
A. Login success at 8:05 am from the school network
B. Login success at 3:12 am from a country the user has never visited ✓
An odd time combined with an unfamiliar location does not match the user's normal behaviour, so it should be investigated.
3. Why do we read a log in time order?
A. It shows the sequence of events, such as failures before a success ✓
B. It makes the log file smaller and faster to store
Timestamps in order let you see what happened first and what followed, so patterns like repeated failures then success stand out.
4. A user normally logs in from Brisbane. The log shows a login from another country just 10 minutes later. What should you do?
A. Treat it as suspicious and check whether the account is compromised ✓
B. Ignore it because every successful login is safe
A login from an unusual place, especially so soon after a normal one, can mean someone else has the password.
5. Which pattern in a log is most likely a normal mistake rather than an attack?
A. One failed login followed by a success a few seconds later ✓
B. Hundreds of failed logins from the same address in one minute
One typo then a correct password is normal. Hundreds of rapid failures are a sign of automated guessing.

Match the Pairs

02:14 FAIL admin 02:14 FAIL admin 02:15 FAIL admin 02:15 OK admin → Many failed logins then one success: someone guessed the password by brute force and got in.
09:05 OK mia IP=Sydney 09:40 OK mia IP=Lagos → A login from an unusual place: the same user logged in from two far-apart locations too fast to be real.
Reading timestamps in order lets you see the sequence of events, so you can tell which failed attempts came before the login that worked. → 03:01 FAIL leo 03:02 FAIL leo 03:04 OK leo
A login at an odd time, such as 3 am when the user is normally asleep, is a pattern worth investigating. → 03:12 OK zoe IP=Perth (zoe usually logs in 08:00-17:00)
Log: 10:00 FAIL ava, 10:01 FAIL ava, 10:02 FAIL ava Conclusion: nothing unusual, ignore it. → Three failed logins in a row for one account is a pattern, not nothing. Ignoring repeated failures can miss a brute-force attack.
Sort log entries by username only, then read the story. → The entries should be in time order. Without sorting by timestamp you cannot see what happened first or spot a pattern.

Key Term

log analysis
Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.

Fill in the Blanks

1. IF status == "FAILED" THEN failCount = failCount + 1 END IF
Hint: Type the variable that keeps count of the failed logins.
2. 02:14 FAILED ava 02:15 FAILED ava 02:16 SUCCESS ava
Hint: Type the status word for the login that finally worked after the failures.
3. IF country != homeCountry THEN flag("Unusual location") END IF
Hint: Type the operator that means not equal to.
4. sortedLog = sort(log, by=timestamp) FOR EACH entry IN sortedLog show(entry)
Hint: Type the log field to sort by so events appear in time order.
5. IF hour < 6 OR hour > 22 THEN flag("Odd time") END IF
Hint: Type the keyword that joins two conditions so that either one can be true.

Spot the Error

Question 1
A failed = 0
B for entry in log:
C if entry == 'OK':
D failed += 1
Line C — The program counts failed logins, so it must check for 'FAIL'. Checking for 'OK' counts successful logins and would miss a run of failed attempts.
Question 2
A fails = 6
B ok = True
C # many fails then a success
D if fails <= 5 and ok:
E print('Possible attack')
Line D — An attack shows up as many failed logins, so the check should be fails >= 5. Using <= 5 would flag few failures and ignore a large number.
Question 3
A attempts = 10
B for line in log:
C if 'FAIL' in line:
D attempts += 1
Line A — A counter must start at 0. Starting at 10 would make the count too high and could trigger false alarms.
Question 4
A home = 'Australia'
B for e in logins
C if e.country != home:
D print('Alert')
Line B — A for loop line must end with a colon. It should be: for e in logins:
Question 5
A 08:01 login fail bob
B 08:02 login fail bob
C 08:03 login fail bob
D 07:04 login ok bob
Line D — Log entries must be in time order. 07:04 comes before the failed logins at 08:01 to 08:03. It should be 08:04, a success right after the failures.

Student with a class code? Join your class →