Spotting an attack in a log file

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A log shows 40 failed logins for one account in two minutes, then one success. What does this pattern most likely suggest?

A A user who simply had a normal busy morning

B A brute-force attack that finally guessed the password

2. Which log entry is the strongest warning sign?

A Login success at 8:05 am from the school network

B Login success at 3:12 am from a country the user has never visited

3. Why do we read a log in time order?

A It shows the sequence of events, such as failures before a success

B It makes the log file smaller and faster to store

4. A user normally logs in from Brisbane. The log shows a login from another country just 10 minutes later. What should you do?

A Treat it as suspicious and check whether the account is compromised

B Ignore it because every successful login is safe

5. Which pattern in a log is most likely a normal mistake rather than an attack?

A One failed login followed by a success a few seconds later

B Hundreds of failed logins from the same address in one minute

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
102:14 FAIL admin 02:14 FAIL admin 02:15 FAIL admin 02:15 OK admin		A03:01 FAIL leo 03:02 FAIL leo 03:04 OK leo
209:05 OK mia IP=Sydney 09:40 OK mia IP=Lagos		BThe entries should be in time order. Without sorting by timestamp you cannot see what happened first or spot a pattern.
3Reading timestamps in order lets you see the sequence of events, so you can tell which failed attempts came before the login that worked.		CA login from an unusual place: the same user logged in from two far-apart locations too fast to be real.
4A login at an odd time, such as 3 am when the user is normally asleep, is a pattern worth investigating.		DMany failed logins then one success: someone guessed the password by brute force and got in.
5Log: 10:00 FAIL ava, 10:01 FAIL ava, 10:02 FAIL ava Conclusion: nothing unusual, ignore it.		E03:12 OK zoe IP=Perth (zoe usually logs in 08:00-17:00)
6Sort log entries by username only, then read the story.		FThree failed logins in a row for one account is a pattern, not nothing. Ignoring repeated failures can miss a brute-force attack.

Definitions

log analysis

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF status == "FAILED" THEN _________ = failCount + 1 END IF

02:14 FAILED ava 02:15 FAILED ava 02:16 _______ ava

IF country __ homeCountry THEN flag("Unusual location") END IF

sortedLog = sort(log, by=_________) FOR EACH entry IN sortedLog show(entry)

IF hour < 6 __ hour > 22 THEN flag("Odd time") END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A failed = 0

B for entry in log:

C if entry == 'OK':

D failed += 1

Question 2

A fails = 6

B ok = True

C # many fails then a success

D if fails <= 5 and ok:

E print('Possible attack')

Question 3

A attempts = 10

B for line in log:

C if 'FAIL' in line:

D attempts += 1

Question 4

A home = 'Australia'

B for e in logins

C if e.country != home:

D print('Alert')

Question 5

A 08:01 login fail bob

B 08:02 login fail bob

C 08:03 login fail bob

D 07:04 login ok bob

Answer Key

Spotting an attack in a log file

Section A: Quick Questions

B — A brute-force attack that finally guessed the password

B — Login success at 3:12 am from a country the user has never visited

A — It shows the sequence of events, such as failures before a success

A — Treat it as suspicious and check whether the account is compromised

A — One failed login followed by a success a few seconds later

Section B: Match the Pairs

02:14 FAIL admin 02:14 FAIL admin 02:15 FAIL admin 02:15 OK admin → Many failed logins then one success: someone guessed the password by brute force and got in.

09:05 OK mia IP=Sydney 09:40 OK mia IP=Lagos → A login from an unusual place: the same user logged in from two far-apart locations too fast to be real.

Reading timestamps in order lets you see the sequence of events, so you can tell which failed attempts came before the login that worked. → 03:01 FAIL leo 03:02 FAIL leo 03:04 OK leo

A login at an odd time, such as 3 am when the user is normally asleep, is a pattern worth investigating. → 03:12 OK zoe IP=Perth (zoe usually logs in 08:00-17:00)

Log: 10:00 FAIL ava, 10:01 FAIL ava, 10:02 FAIL ava Conclusion: nothing unusual, ignore it. → Three failed logins in a row for one account is a pattern, not nothing. Ignoring repeated failures can miss a brute-force attack.

Sort log entries by username only, then read the story. → The entries should be in time order. Without sorting by timestamp you cannot see what happened first or spot a pattern.

Section C: Definitions

log analysis — Reading a log in time order for patterns, like many failed logins then one success, odd times or unfamiliar places, to spot an attack.

Section D: Fill in the Blanks

IF status == "FAILED" THEN
    failCount = failCount + 1
END IF

02:14 FAILED ava
02:15 FAILED ava
02:16 SUCCESS ava

IF country != homeCountry THEN
    flag("Unusual location")
END IF

sortedLog = sort(log, by=timestamp)
FOR EACH entry IN sortedLog
    show(entry)

IF hour < 6 OR hour > 22 THEN
    flag("Odd time")
END IF

Section E: Spot the Error

C — The program counts failed logins, so it must check for 'FAIL'. Checking for 'OK' counts successful logins and would miss a run of failed attempts.

D — An attack shows up as many failed logins, so the check should be fails >= 5. Using <= 5 would flag few failures and ignore a large number.

A — A counter must start at 0. Starting at 10 would make the count too high and could trigger false alarms.

B — A for loop line must end with a colon. It should be: for e in logins:

D — Log entries must be in time order. 07:04 comes before the failed logins at 08:01 to 08:03. It should be 08:04, a success right after the failures.