Middlemind Games

>Tutorial 6: Blue Ice2: Active Server Defense Automation

Author: Brian A. Ree

Files/Resources for this Tutorial
Project Files v0.4.0.7_python2.7 (PyCharm)

0: Introduction

In the previous tutorial we altered our tensorflow logistic regression project to support loading apache log files and modified apache log files that have the proper category, good or bad access, appended to each row. We used these processed log files to train and validate our neural network. We introduced the ability to pass in extras into our feature and statistics generation step. The exras we provided are an array of valid URLs and URL roots for our web server. Using this information we trained and validated a neural network with aroun 98% accuracy to determine if a web server access log entry was an attack or a valid use case.

In this tutorial we're going to enhance our eval_type custom evaluation code to support a callback method that can access the active tensorflow session, the regression model, and the configuration dictionary. We're attempting to use ur trained neural network to programmatically process a new or current apache log file. We will then save our list of bad IP addresses to a file so that we can use the block list IP address in a firewall configuration to protect our server.

In order to accomplish this we need to use the checkpoints feature of our code so that we can save/restore our trained tensoflow neural network to answer a series of queries for us and use its resulting inference to decide if a log entry is an attack or a valid use case.

1: RegModelLogistic Updates

First we'll take a look at the changes to our RegModelLogistic class. Let's list some of the new methods we have added along with a short description.

setCheckPointSave: Sets the row interval at which checkpoints are saved if checkpoints have been turned on.
setCheckPointOn: Sets a toggle that turns checkpoint saves on.
setCallbackMethod: Sets a callback method for custom processing with a tensorflow session.
setExeCfg: Sets a local dictionary with a reference to the execution configuration dictionary for this model run.
predict: Uses the current neural network state to predict a Y value given an X value.
predictColumn: Converts the prediction into an output category, remember we are using logistic regression to answer yes or no, our two categories in this case are yes and no.
interpretPredictColumn: Converts the predicted column into a boolean representation. We will assume category 1 means true and category 2 means false. This is controlled by the answer order in the LoadTensorData class.

We should also mention the inclusion of the dataModelAnsColCount member variable which tracks how many categories we are solving against in our logistic regression model, we are currently focused on yes/no or two categories. Our linear regression model used a 1 in all cases due to its lineality. Let's go over our new class methods in a little more detail first, then we'll review our execution configuration code to see the changes in action when we run our logistic regression model. The code for our new methods is listed below.

def setCheckPointSave(self, cps):
    self.checkpointSave = cps;
# edef

def setCheckPointOn(self, cpo):
    self.checkpoint = cpo;
# edef

def setCallbackMethod(self, mthd):
    self.callbackMethod = mthd;
# edef

def setExeCfg(self, cfg):
    self.exeCfg = cfg
# edef

def predict(self, sess, test_x):
    Y_predicted = self.inference(test_x)

    if self.verbose:
        print('PredictionArgMax: %s' % sess.run(tf.argmax(Y_predicted, 1)))
        print('Prediction: %s' % sess.run(Y_predicted))
    # eif

    return sess.run(Y_predicted)
# edef

def predictColumn(self, sess, test_x):
    return sess.run(tf.argmax(self.predict(sess, test_x), 1))
# eif

def interpretPredictColumn(self, sess, test_x):
    if float(self.predictColumn(sess, test_x)) == 0.0:
        return True
    # eif

    return False
# eif

The setCheckPointSave and setCheckPointOn methods are just simple setter methods for variables that control the checkpoint system. The setCheckPointOn method toggles the checkpoint system on or off, while the setCheckPointSave method sets the interval of rows to be processed before a new checkpoint is saved. The setExeCfg method is also a setter method and is designed to store a copy of the execution configuration settings dictionary so the settings can be passed onto the callback method. Which brings us to the setCallbackMethod method, which stores a reference to a callback method. In pythin we can reference a method like a variable so we can easily pass in the name of a local method to be used as the callback method. The callback method will give us a place in our code to run queries against a trained neural network in a valid tensorflow session with access to the configuration settings.

The brings us to our new prediction methods. The core method, predict, returns the predicted y value tensor given an X value tensor. Since we are using logistic regression the y value tensor is a vector with the probabilities that the correct answer is a certain category, for all given categories. In order to interpret these results we take the category with the highest probability as our answer. The method predictColumn does this for us. Finally we have the interpretPredictColumn method which converts the predictColumn method results into a boolean representation. Because we are only working with yes and no categories we can convert them to a boolean representation with this method.

One last thing to do before we move on. Let's look at our callback method code to see it in action in the RegModelLogistic class.

if self.callbackMethod:
    self.callbackMethod(self, sess, self.evalType, self.exeCfg)
# eif

2: Main Updates

The code is straight forward, the parameters that the callback method expects are unknown to the RegModelLogistic class. It simply passes in a self reference, a reference to the current tensorflow session, the custom eval_type value, and a reference to the current execution configuration dictionary entry. Now let's jump to Main and see our new code in action. The next code block lists the contents of the Main class, we'll be reviewing some key points from it next.

#!/usr/bin/env python

# base imports
import sys
import tensorflow as tf

# user imports
import LoadCsvData
import LoadApacheLogData
import Data2DataRow
import LoadFeatureData
import LoadTensorData
import DataRow2Tensor
import RegModelLinear
import RegModelLogistic


dataDir = "./data"
appVersion = "0.4.0.6"
apacheLogFile = dataDir + "/evaluate/apache_eval_log.txt"
ipOutputFile = dataDir + "/output/ip_block_list.txt"

def run(exeCfg):
    type = exeCfg['type']
    data_2_datarow_type = exeCfg['data_2_datarow_type']
    datarow_2_tensor_type = exeCfg['datarow_2_tensor_type']
    version = exeCfg['version']
    reset = exeCfg['reset']
    checkpoint = exeCfg['checkpoint']
    verbose = exeCfg['verbose']
    limitLoad = exeCfg['limitLoad']
    rowLimit = exeCfg['rowLimit']
    validatePrct = exeCfg['validatePrct']
    trainPrct = exeCfg['trainPrct']
    randomSeed = exeCfg['randomSeed']
    learning_rate = exeCfg['learning_rate']
    log_reg_positive_result = exeCfg['log_reg_positive_result']
    lin_reg_positive_result = exeCfg['lin_reg_positive_result']
    model_type = exeCfg['model_type']
    loader = exeCfg['loader']
    cleanData = exeCfg['cleanData']
    trainStepsMultiplier = exeCfg['trainStepsMultiplier']
    dataMap = Data2DataRow.mapping[data_2_datarow_type]
    files = exeCfg['files']
    featureType = exeCfg['feature_type']
    logPrint = exeCfg['logPrint']

    checkpointSave = 1000
    if 'checkpointSave' in exeCfg:
        checkpointSave = exeCfg['checkpointSave']
    # eif

    evalType = exeCfg['eval_type']
    data = None
    fData = None
    tData = None
    tfModel = None

    print("Found loader: " + loader)
    if loader == 'load_csv_data':
        data = LoadCsvData.LoadCsvData()
        data.limitLoad = limitLoad
        data.rowLimit = rowLimit
        data.verbose = verbose

        for file in files:
            csvFileName = files[file]['name']
            appendCols = files[file]['appendCols']
            data.loadData(csvFileName, type, version, reset, dataMap, appendCols)
        # efl

    elif loader == 'load_apache_log_data':
        data = LoadApacheLogData.LoadApacheLogData()
        data.limitLoad = limitLoad
        data.rowLimit = rowLimit
        data.verbose = verbose

        for file in files:
            logFileName = files[file]['name']
            appendCols = files[file]['appendCols']
            data.loadData(logFileName, type, version, reset, dataMap, appendCols)
        # efl

    # eif

    print("Found feature type: " + featureType)
    fData = LoadFeatureData.LoadFeatureData(limitLoad, rowLimit, cleanData, verbose, data)
    if 'extras' in exeCfg:
        fData.setExtras(exeCfg['extras'])
    # eif

    if featureType != '':
        fData.generateData(featureType)
    else:
        fData.generateData('')
    # eif

    tData = LoadTensorData.LoadTensorData(verbose, trainPrct, validatePrct, fData)
    tData.generateData(DataRow2Tensor.columns[datarow_2_tensor_type])

    if model_type == 'linear_regression':
        tfModel = RegModelLinear.RegModelLinear(verbose, tData, lin_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
        tfModel.setCheckPointSave(checkpointSave)
        tfModel.setCheckPointOn(checkpoint)
        tfModel.startTraining()

    elif model_type == 'logistic_regression':
        tfModel = RegModelLogistic.RegModelLogistic(verbose, tData, log_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
        tfModel.setCheckPointSave(checkpointSave)
        tfModel.setCheckPointOn(checkpoint)
        tfModel.setExeCfg(exeCfg)
        tfModel.setCallbackMethod(evalCallback)
        tfModel.startTraining()

    # eif

# edef

def evalCallback(regModel, tfSess, evalType, exeCfg):
    print("evalCallback: " + evalType)
    if evalType == 'blue_ice':
        regModelLog = regModel
        sess = tfSess

        # print("Test1: [Bad] %s" % regModel.interpretPredictColumn(sess, [[127.0, 1.0, 0.0, 1.0, 0.0, 400.0, 0.0]]))
        # print("Test2: [Good] %s" % regModel.interpretPredictColumn(sess, [[127.0, 2.0, 0.0, 1.0, 1.0, 200.0, 0.0]]))
        # print("Test3: [Bad] %s" % regModel.interpretPredictColumn(sess, [[127.0, 3.0, 0.0, 1.0, 0.0, 400.0, 0.0]]))
        # print("Test4: [Good] %s" % regModel.interpretPredictColumn(sess, [[127.0, 4.0, 0.0, 1.0, 1.0, 200.0, 0.0]]))

        # load config settings
        data_2_datarow_type = exeCfg['data_2_datarow_type']
        logFileName = apacheLogFile
        type = exeCfg['type']
        version = exeCfg['version']
        reset = True # exeCfg['reset']
        dataMap = Data2DataRow.mapping[data_2_datarow_type]
        appendCols = []
        featureType = exeCfg['feature_type']
        verbose = exeCfg['verbose']
        limitLoad = exeCfg['limitLoad']
        rowLimit = exeCfg['rowLimit']
        cleanData = exeCfg['cleanData']
        datarow_2_tensor_type = exeCfg['datarow_2_tensor_type']
        # validatePrct = exeCfg['validatePrct']
        # trainPrct = exeCfg['trainPrct']
        # model_type = exeCfg['model_type']
        columnMap = DataRow2Tensor.columns[datarow_2_tensor_type]

        # load unprocessed log file
        data = LoadApacheLogData.LoadApacheLogData()
        data.loadData(logFileName, type, version, reset, dataMap, appendCols)

        # generate features from unprocessed log file
        print("Found feature type: " + featureType)
        fData = LoadFeatureData.LoadFeatureData(limitLoad, rowLimit, cleanData, verbose, data)
        if 'extras' in exeCfg:
            fData.setExtras(exeCfg['extras'])
        # eif

        if featureType != '':
            fData.generateData(featureType)
        else:
            fData.generateData('')
        # eif

        # run eval on unprocessed log file entries
        val2 = []
        val3 = []
        ips = {}
        rowcnt = 0
        totalAttacks = 0

        ofile = open(ipOutputFile, 'w')

        for row in fData.rows:
            val2 = []
            val = []
            for col in columnMap:
                val.append(float(row.getMemberByName(col)))
            # efl
            val2.append(val)

            res = regModel.interpretPredictColumn(sess, tf.to_float(val2))
            ip1 = int(row.getMemberByName('Ip1'))
            ip2 = int(row.getMemberByName('Ip2'))
            ip3 = int(row.getMemberByName('Ip3'))
            ip4 = int(row.getMemberByName('Ip4'))
            ipIdx = str(ip1) + "_" + str(ip2) + "_" + str(ip3) + "_" + str(ip4)
            ipFull = str(ip1) + "." + str(ip2) + "." + str(ip3) + "." + str(ip4)
            url = str(row.getMemberByName('Url')).replace("_", "/")

            if res == False:
                print("Row%i: Hack %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))

                if ipIdx not in ips:
                    ips[ipIdx] = 1
                    ofile.write(ipFull + "\n")
                else:
                    cnt = ips[ipIdx]
                    cnt = cnt + 1
                    ips[ipIdx] = cnt
                # eif
                totalAttacks = totalAttacks + 1
            else:
                print("Row%i: Normal Use %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))
            # eif

            rowcnt += 1
        # efl

        ofile.close()
        print("Found %i attack IP addresses with %i attacks." % (len(ips), totalAttacks))
    # eif
# edef

def main(args):

    print("Application Version: " + appVersion)

    exes = {
        "blue_ice_log_reg":
        {
            # Apache Log File => alf
            'type': 'alf',
            'data_2_datarow_type': 'blue_ice',
            'datarow_2_tensor_type': 'blue_ice_log_reg_hack_attack',
            'version': '1.0',
            'reset': False,
            'checkpoint': True,
            'limitLoad': False,
            'cleanData': True,
            'verbose': False,
            'rowLimit': 25,
            'validatePrct': 0.20,
            'trainPrct': 0.80,
            'randomSeed': False,
            'trainStepsMultiplier': 20,
            'learning_rate': 0.000001,
            'log_reg_positive_result': 0.50,
            'lin_reg_positive_result': 0.50,
            'model_type': 'logistic_regression',
            'loader': 'load_apache_log_data',
            'feature_type': 'blue_ice_log_reg',
            'logPrint': 500,
            'checkpointSave': 500,
            'eval_type': 'blue_ice',

            'files': {
                'file1': {'name': dataDir + "/access_logs/access.log.1", 'appendCols': []},
                'file2': {'name': dataDir + "/access_logs/access.log.2", 'appendCols': []},
                'file3': {'name': dataDir + "/access_logs/access.log.3", 'appendCols': []},
                'file4': {'name': dataDir + "/access_logs/access.log.4", 'appendCols': []},
                'file5': {'name': dataDir + "/access_logs/access.log.5", 'appendCols': []},
                'file6': {'name': dataDir + "/access_logs/access.log.6", 'appendCols': []},
                'file7': {'name': dataDir + "/access_logs/access.log.7", 'appendCols': []},
                'file8': {'name': dataDir + "/access_logs/access.log.8", 'appendCols': []},
                'file9': {'name': dataDir + "/access_logs/access.log.9", 'appendCols': []},
                'file10': {'name': dataDir + "/access_logs/access.log.10", 'appendCols': []},
                'file11': {'name': dataDir + "/access_logs/access.log.11", 'appendCols': []},
                'file12': {'name': dataDir + "/access_logs/access.log.12", 'appendCols': []},
                'file13': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log", 'appendCols': []},
                'file14': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log.1", 'appendCols': []},
                'file15': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log.2", 'appendCols': []},
                'file16': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log.3", 'appendCols': []},
                'file17': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log.4", 'appendCols': []},
                'file18': {'name': dataDir + "/other_vhosts_access/other_vhosts_access.log.5", 'appendCols': []},
            },

            'extras': [
                '_websvc.php',
                '_websvcclient.php',
                '_scripts_utils_Log.js',
                '_scripts_utils_md5.js',
                '_scripts_utils_BufferedReader.js',
                '_scripts_webutils_MmgMd5.js',
                '_scripts_webutils_MsNewsSrchWebSvcClient.js',
                '_scripts_webutils_SaWebSvcClient.js',
                '_scripts_webutils_YhStockQuoteWebSvcClient.js',
                '_scripts_webutils_MsTxtSntWebSvcClient.js',
                '_scripts_stockanalytics_StockAnalytics.js',
                '_scripts_models_ModelsConfig.js',
                '_scripts_models_ModelArticlesCount.js',
                '_scripts_models_ModelArticlesGetAllActive.js',
                '_scripts_models_ModelDataSourcesCount.js',
                '_scripts_models_ModelStockQuotesCount.js',
                '_scripts_models_ModelDataSourcesUsageCount.js',
                '_scripts_models_ModelTargetSearchTextCount.js',
                '_scripts_models_ModelTargetSymbolsCount.js',
                '_scripts_models_ModelTextRefinementCount.js',
                '_scripts_models_ModelDataSourcesUsageSummary.js',
                '_scripts_models_ModelDataSourcesGetAllActive.js',
                '_scripts_models_ModelTargetSearchTextGetAllActive.js',
                '_scripts_models_ModelStockQuotesGetAllActive.js',
                '_scripts_models_ModelTargetSymbolsGetAllActive.js',
                '_scripts_models_ModelTextRefinementGetAllActive.js',
                '_scripts_views_ViewArticlesCount.js',
                '_scripts_views_ViewArticlesGetAllActive.js',
                '_scripts_views_ViewDataSourcesCount.js',
                '_scripts_views_ViewStockQuotesCount.js',
                '_scripts_views_ViewDataSourcesUsageCount.js',
                '_scripts_views_ViewTargetSearchTextCount.js',
                '_scripts_views_ViewTargetSymbolsCount.js',
                '_scripts_views_ViewTextRefinementCount.js',
                '_scripts_views_ViewDataSourcesUsageSummary.js',
                '_scripts_views_ViewDataSourcesGetAllActive.js',
                '_scripts_views_ViewStockQuotesGetAllActive.js',
                '_scripts_views_ViewTargetSearchTextGetAllActive.js',
                '_scripts_views_ViewTargetSymbolsGetAllActive.js',
                '_scripts_views_ViewTextRefinementGetAllActive.js',
                '_scripts_controllers_ControllerArticlesCount.js',
                '_scripts_controllers_ControllerDataSourcesCount.js',
                '_scripts_controllers_ControllerArticlesGetAllActive.js',
                '_scripts_controllers_ControllerStockQuotesCount.js',
                '_scripts_controllers_ControllerDataSourcesUsageCount.js',
                '_scripts_controllers_ControllerTargetSearchTextCount.js',
                '_scripts_controllers_ControllerTargetSymbolsCount.js',
                '_scripts_controllers_ControllerDataSourcesUsageSummary.js',
                '_scripts_controllers_ControllerTextRefinementCount.js',
                '_scripts_controllers_ControllerTargetSearchTextGetAllActive.js',
                '_scripts_controllers_ControllerDataSourcesGetAllActive.js',
                '_scripts_controllers_ControllerStockQuotesGetAllActive.js',
                '_scripts_controllers_ControllerTargetSymbolsGetAllActive.js',
                '_scripts_controllers_ControllerTextRefinementGetAllActive.js'
            ]
        }
    }

    run(exes["blue_ice_log_reg"])

# edef

if __name__ == '__main__':
    main(sys.argv)
# eif

Let's talk about some new variables we've added to Maian since our last tutorial. Our BlueIce active server defence code is going to have to be run at interval, think cron job, so it will need to know where the current apache access log file is stored. The next variable ipOutputFile is, you guessed it, a file with a list of our attack source IP addresses in it. We can use this output file to possibly configure a firewall and close the loop on our active server defense code. We could potentially have a fully automated implementation. We'll look at the execution code next and review the small changes we've made there.

def run(exeCfg):
    type = exeCfg['type']
    data_2_datarow_type = exeCfg['data_2_datarow_type']
    datarow_2_tensor_type = exeCfg['datarow_2_tensor_type']
    version = exeCfg['version']
    reset = exeCfg['reset']
    checkpoint = exeCfg['checkpoint']
    verbose = exeCfg['verbose']
    limitLoad = exeCfg['limitLoad']
    rowLimit = exeCfg['rowLimit']
    validatePrct = exeCfg['validatePrct']
    trainPrct = exeCfg['trainPrct']
    randomSeed = exeCfg['randomSeed']
    learning_rate = exeCfg['learning_rate']
    log_reg_positive_result = exeCfg['log_reg_positive_result']
    lin_reg_positive_result = exeCfg['lin_reg_positive_result']
    model_type = exeCfg['model_type']
    loader = exeCfg['loader']
    cleanData = exeCfg['cleanData']
    trainStepsMultiplier = exeCfg['trainStepsMultiplier']
    dataMap = Data2DataRow.mapping[data_2_datarow_type]
    files = exeCfg['files']
    featureType = exeCfg['feature_type']
    logPrint = exeCfg['logPrint']

    checkpointSave = 1000
    if 'checkpointSave' in exeCfg:
        checkpointSave = exeCfg['checkpointSave']
    # eif

    evalType = exeCfg['eval_type']
    data = None
    fData = None
    tData = None
    tfModel = None

    print("Found loader: " + loader)
    if loader == 'load_csv_data':
        data = LoadCsvData.LoadCsvData()
        data.limitLoad = limitLoad
        data.rowLimit = rowLimit
        data.verbose = verbose

        for file in files:
            csvFileName = files[file]['name']
            appendCols = files[file]['appendCols']
            data.loadData(csvFileName, type, version, reset, dataMap, appendCols)
        # efl

    elif loader == 'load_apache_log_data':
        data = LoadApacheLogData.LoadApacheLogData()
        data.limitLoad = limitLoad
        data.rowLimit = rowLimit
        data.verbose = verbose

        for file in files:
            logFileName = files[file]['name']
            appendCols = files[file]['appendCols']
            data.loadData(logFileName, type, version, reset, dataMap, appendCols)
        # efl

    # eif

    print("Found feature type: " + featureType)
    fData = LoadFeatureData.LoadFeatureData(limitLoad, rowLimit, cleanData, verbose, data)
    if 'extras' in exeCfg:
        fData.setExtras(exeCfg['extras'])
    # eif

    if featureType != '':
        fData.generateData(featureType)
    else:
        fData.generateData('')
    # eif

    tData = LoadTensorData.LoadTensorData(verbose, trainPrct, validatePrct, fData)
    tData.generateData(DataRow2Tensor.columns[datarow_2_tensor_type])

    if model_type == 'linear_regression':
        tfModel = RegModelLinear.RegModelLinear(verbose, tData, lin_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
        tfModel.setCheckPointSave(checkpointSave)
        tfModel.setCheckPointOn(checkpoint)
        tfModel.startTraining()

    elif model_type == 'logistic_regression':
        tfModel = RegModelLogistic.RegModelLogistic(verbose, tData, log_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
        tfModel.setCheckPointSave(checkpointSave)
        tfModel.setCheckPointOn(checkpoint)
        tfModel.setExeCfg(exeCfg)
        tfModel.setCallbackMethod(evalCallback)
        tfModel.startTraining()

    # eif

# edef

There are only a few small changes so we'll cover them quickly and move onto the review of our callback method. The first new pieces of code safely attempt to load some new execution configuration settings that may not be used in older execution configuration entries so we protect our code from crashing by putting a check in place before accessing the new dictionary keys.

checkpointSave = 1000
if 'checkpointSave' in exeCfg:
    checkpointSave = exeCfg['checkpointSave']
# eif

You'll also notice that feature generation is a little bit cleaner and supports passing in an object of extras to supplement the feature generation process in this case.

print("Found feature type: " + featureType)
fData = LoadFeatureData.LoadFeatureData(limitLoad, rowLimit, cleanData, verbose, data)
if 'extras' in exeCfg:
    fData.setExtras(exeCfg['extras'])
# eif
if featureType != '':
    fData.generateData(featureType)
else:
    fData.generateData('')
# eif

The only other major changes to this method is the inclusion of setter methods in the model execution code. This new code just utilizes the new setter methods of our regression classes to pass our new configuration settings dictionary entry on to the actual model. The model can then pass this information on to a callback method if need be.

tData = LoadTensorData.LoadTensorData(verbose, trainPrct, validatePrct, fData)
tData.generateData(DataRow2Tensor.columns[datarow_2_tensor_type])

if model_type == 'linear_regression':
    tfModel = RegModelLinear.RegModelLinear(verbose, tData, lin_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
    tfModel.setCheckPointSave(checkpointSave)
    tfModel.setCheckPointOn(checkpoint)
    tfModel.startTraining()

elif model_type == 'logistic_regression':
    tfModel = RegModelLogistic.RegModelLogistic(verbose, tData, log_reg_positive_result, randomSeed, trainStepsMultiplier, logPrint, learning_rate, evalType)
    tfModel.setCheckPointSave(checkpointSave)
    tfModel.setCheckPointOn(checkpoint)
    tfModel.setExeCfg(exeCfg)
    tfModel.setCallbackMethod(evalCallback)
    tfModel.startTraining()

# eif

3: Callback Method for Custom Processing

So far so good, the code looks clean, just a few small changes here and there and we've added a lot of new functionality to our project. We had a good foundation to work with and we were able to leverage some of the elements of the good design decisions we made earlier to accomodate our new requirements. Let's look at our new callback method next.

def evalCallback(regModel, tfSess, evalType, exeCfg):
    print("evalCallback: " + evalType)
    if evalType == 'blue_ice':
        regModelLog = regModel
        sess = tfSess

        # print("Test1: [Bad] %s" % regModel.interpretPredictColumn(sess, [[127.0, 1.0, 0.0, 1.0, 0.0, 400.0, 0.0]]))
        # print("Test2: [Good] %s" % regModel.interpretPredictColumn(sess, [[127.0, 2.0, 0.0, 1.0, 1.0, 200.0, 0.0]]))
        # print("Test3: [Bad] %s" % regModel.interpretPredictColumn(sess, [[127.0, 3.0, 0.0, 1.0, 0.0, 400.0, 0.0]]))
        # print("Test4: [Good] %s" % regModel.interpretPredictColumn(sess, [[127.0, 4.0, 0.0, 1.0, 1.0, 200.0, 0.0]]))

        # load config settings
        data_2_datarow_type = exeCfg['data_2_datarow_type']
        logFileName = apacheLogFile
        type = exeCfg['type']
        version = exeCfg['version']
        reset = True # exeCfg['reset']
        dataMap = Data2DataRow.mapping[data_2_datarow_type]
        appendCols = []
        featureType = exeCfg['feature_type']
        verbose = exeCfg['verbose']
        limitLoad = exeCfg['limitLoad']
        rowLimit = exeCfg['rowLimit']
        cleanData = exeCfg['cleanData']
        datarow_2_tensor_type = exeCfg['datarow_2_tensor_type']
        # validatePrct = exeCfg['validatePrct']
        # trainPrct = exeCfg['trainPrct']
        # model_type = exeCfg['model_type']
        columnMap = DataRow2Tensor.columns[datarow_2_tensor_type]

        # load unprocessed log file
        data = LoadApacheLogData.LoadApacheLogData()
        data.loadData(logFileName, type, version, reset, dataMap, appendCols)

        # generate features from unprocessed log file
        print("Found feature type: " + featureType)
        fData = LoadFeatureData.LoadFeatureData(limitLoad, rowLimit, cleanData, verbose, data)
        if 'extras' in exeCfg:
            fData.setExtras(exeCfg['extras'])
        # eif

        if featureType != '':
            fData.generateData(featureType)
        else:
            fData.generateData('')
        # eif

        # run eval on unprocessed log file entries
        val2 = []
        val3 = []
        ips = {}
        rowcnt = 0
        totalAttacks = 0

        ofile = open(ipOutputFile, 'w')

        for row in fData.rows:
            val2 = []
            val = []
            for col in columnMap:
                val.append(float(row.getMemberByName(col)))
            # efl
            val2.append(val)

            res = regModel.interpretPredictColumn(sess, tf.to_float(val2))
            ip1 = int(row.getMemberByName('Ip1'))
            ip2 = int(row.getMemberByName('Ip2'))
            ip3 = int(row.getMemberByName('Ip3'))
            ip4 = int(row.getMemberByName('Ip4'))
            ipIdx = str(ip1) + "_" + str(ip2) + "_" + str(ip3) + "_" + str(ip4)
            ipFull = str(ip1) + "." + str(ip2) + "." + str(ip3) + "." + str(ip4)
            url = str(row.getMemberByName('Url')).replace("_", "/")

            if res == False:
                print("Row%i: Hack %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))

                if ipIdx not in ips:
                    ips[ipIdx] = 1
                    ofile.write(ipFull + "\n")
                else:
                    cnt = ips[ipIdx]
                    cnt = cnt + 1
                    ips[ipIdx] = cnt
                # eif
                totalAttacks = totalAttacks + 1
            else:
                print("Row%i: Normal Use %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))
            # eif

            rowcnt += 1
        # efl

        ofile.close()
        print("Found %i attack IP addresses with %i attacks." % (len(ips), totalAttacks))
    # eif
# edef

For the most part this method resembles a little version of the run method we've been using thus far so let's review what it's supposed to do. The evalCallback method is going to scan the current apache access log file for hack attempts then print out a list of IP addresses to block. It will use the last saved checkpoint from our training session to restore the neural network to the latest training state then query the neural network for a prediction on each log entry in the access log file. All hack attempt IP addresses are writing to a block IP address list. To do this we need to prep the log data in almost the same way we needed to prep it for training and validation. While we don't need an answer category prepended to each row we do need to process the data all the way up to and incuding the feature generation and statistics step. In thi way we've encoded all our data points that can't be used directly in tensorflow, think URL, IP address, etc.

This is where passing around the config dictionary comes in handy. We can load the same processing settings that we passed into the run method. This means that we can process each row entry individually in the same way that we processed all the apache access log files for training and validating our neural network. We could attempt to process things in bulk in the same way we did our training and validation but we want more granular control here so we'll loop over the contents of the current apache access log file and submit a query for each row to our neural network. Depending on the resulting prediction we may write the IP address to our IP block list or not.

# run eval on unprocessed log file entries
val2 = []
val3 = []
ips = {}
rowcnt = 0
totalAttacks = 0

ofile = open(ipOutputFile, 'w')

for row in fData.rows:
    val2 = []
    val = []
    for col in columnMap:
        val.append(float(row.getMemberByName(col)))
    # efl
    val2.append(val)

    res = regModel.interpretPredictColumn(sess, tf.to_float(val2))
    ip1 = int(row.getMemberByName('Ip1'))
    ip2 = int(row.getMemberByName('Ip2'))
    ip3 = int(row.getMemberByName('Ip3'))
    ip4 = int(row.getMemberByName('Ip4'))
    ipIdx = str(ip1) + "_" + str(ip2) + "_" + str(ip3) + "_" + str(ip4)
    ipFull = str(ip1) + "." + str(ip2) + "." + str(ip3) + "." + str(ip4)
    url = str(row.getMemberByName('Url')).replace("_", "/")

    if res == False:
        print("Row%i: Hack %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))

        if ipIdx not in ips:
            ips[ipIdx] = 1
            ofile.write(ipFull + "\n")
        else:
            cnt = ips[ipIdx]
            cnt = cnt + 1
            ips[ipIdx] = cnt
        # eif
        totalAttacks = totalAttacks + 1
    else:
        print("Row%i: Normal Use %s %i.%i.%i.%i %s" % (rowcnt, res, ip1, ip2, ip3, ip4, url))
    # eif

    rowcnt += 1
# efl

ofile.close()
print("Found %i attack IP addresses with %i attacks." % (len(ips), totalAttacks))

As we process the rows from our log file we store the number of time an IP address attacked us in a local dictionary, we also use this design to write out the IP address to our block list the first time an attack is detected from a given IP address. We could alter this code to require a minimum number of attacks before adding the IP to the block list. I'll leave that up to you though. Now that we can scan apache logs, query our trained neural network, and write an IP block list as an output file how can we automate it all and create true active server defence? Let's see, following is a link to creating cron job entries on Ubuntu linux.

Scheduling Cron Jobs on Ubuntu Linux

Using this scheduling system we can run our apache access log scan at interval, say every few minutes or every hour and react to the resulting IP block list accordingly. Let's say we scan the apache logs every 15 minutes and update our firewall blocking rules every 20 minutes. That gives our apache log scanning code approximately 5 minutes to run before we try to adjust our firewall. We could just tie everything together with one overarching script that runs each pieces in sequence but I'll leave that up to you to do.

Now if we want to be able to block IP addresses based on our generated block list we'll have to use a firewall of some kind. The following link shows you how to use the IPTABLES firewall and IP routing to block list of IP addresses.

Block IP Address List with IP Tables

Now with a little refinement, some optimization on how we process current apache logs, and a new script or two we can completely automate the creation and implementation of an IP address block list using tensorflow neural networks, some elbo grease, cron, and IPTABLES. Congratulations you've just built an automated server defense solution! Below is the ouput from scanning roughly 445 new apache access log entries against a trained neural network.

Application Version: 0.4.0.6
Found loader: load_apache_log_data


Loading Data: ./data/access_logs/access.log.3 Type: alf Version: 1.0 Reset: False
Loaded 8 rows from this data file.
CleanCount: 0 RowCount: 7 RowsFound: 7


Loading Data: ./data/access_logs/access.log.2 Type: alf Version: 1.0 Reset: False
Loaded 6 rows from this data file.
CleanCount: 0 RowCount: 13 RowsFound: 13


Loading Data: ./data/access_logs/access.log.1 Type: alf Version: 1.0 Reset: False
Loaded 647 rows from this data file.
CleanCount: 0 RowCount: 656 RowsFound: 656


Loading Data: ./data/access_logs/access.log.10 Type: alf Version: 1.0 Reset: False
Loaded 10 rows from this data file.
CleanCount: 0 RowCount: 662 RowsFound: 662


Loading Data: ./data/access_logs/access.log.7 Type: alf Version: 1.0 Reset: False
Loaded 8 rows from this data file.
CleanCount: 0 RowCount: 669 RowsFound: 669


Loading Data: ./data/access_logs/access.log.6 Type: alf Version: 1.0 Reset: False
Loaded 13 rows from this data file.
CleanCount: 0 RowCount: 682 RowsFound: 682


Loading Data: ./data/access_logs/access.log.5 Type: alf Version: 1.0 Reset: False
Loaded 3 rows from this data file.
CleanCount: 0 RowCount: 685 RowsFound: 685


Loading Data: ./data/access_logs/access.log.4 Type: alf Version: 1.0 Reset: False
Loaded 13 rows from this data file.
CleanCount: 0 RowCount: 698 RowsFound: 698


Loading Data: ./data/access_logs/access.log.9 Type: alf Version: 1.0 Reset: False
Loaded 9 rows from this data file.
CleanCount: 0 RowCount: 707 RowsFound: 707


Loading Data: ./data/access_logs/access.log.8 Type: alf Version: 1.0 Reset: False
Loaded 5 rows from this data file.
CleanCount: 0 RowCount: 712 RowsFound: 712


Loading Data: ./data/access_logs/access.log.11 Type: alf Version: 1.0 Reset: False
Loaded 2 rows from this data file.
CleanCount: 0 RowCount: 714 RowsFound: 714


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log.5 Type: alf Version: 1.0 Reset: False
Loaded 988 rows from this data file.
CleanCount: 0 RowCount: 1551 RowsFound: 1551


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log.3 Type: alf Version: 1.0 Reset: False
Loaded 863 rows from this data file.
CleanCount: 0 RowCount: 2414 RowsFound: 2414


Loading Data: ./data/access_logs/access.log.12 Type: alf Version: 1.0 Reset: False
Loaded 32 rows from this data file.
CleanCount: 0 RowCount: 2442 RowsFound: 2442


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log.4 Type: alf Version: 1.0 Reset: False
Loaded 635 rows from this data file.
CleanCount: 0 RowCount: 3076 RowsFound: 3076


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log.1 Type: alf Version: 1.0 Reset: False
Loaded 228 rows from this data file.
CleanCount: 0 RowCount: 3294 RowsFound: 3294


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log.2 Type: alf Version: 1.0 Reset: False
Loaded 428 rows from this data file.
CleanCount: 0 RowCount: 3718 RowsFound: 3718


Loading Data: ./data/other_vhosts_access/other_vhosts_access.log Type: alf Version: 1.0 Reset: False
Loaded 4 rows from this data file.
CleanCount: 0 RowCount: 3722 RowsFound: 3722
Found feature type: blue_ice_log_reg


Generating Feature Data: Type: blue_ice_log_reg
Loaded 3722 rows from this data file.
Cleaning row data...
CleanCount: 0 RowCount: 3722 RowsFound: 3722


Generating Tensor Data:
TensorRow Answer Shape: (3722, 2)
TensorRow Data Shape: (3722, 7)
TensorRow Count: 3722
TensorTrain Answer Shape: (2977, 2)
TensorTrain Data Shape: (2977, 7)
TensorTrain Count: 2977
2017-08-10 19:02:53.065216: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use SSE4.1 instructions, but these are available on your machine and could speed up CPU computations.
2017-08-10 19:02:53.065231: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use SSE4.2 instructions, but these are available on your machine and could speed up CPU computations.
2017-08-10 19:02:53.065237: W tensorflow/core/platform/cpu_feature_guard.cc:45] The TensorFlow library wasn't compiled to use AVX instructions, but these are available on your machine and could speed up CPU computations.
TensorValidate Answer Shape: (743, 2)
TensorValidate Data Shape: (743, 7)
TensorValidate Count: 743
Found training steps: 59540
Found tensor dimension: 7x2
Weight: (7, 2)
Bias: (2,)
('Loss: ', [1.9656322])
Accuracy: 0.9825
Custom Evaluation: blue_ice
Test1: [Bad] False
Test2: [Good] True
Test3: [Bad] False
Test4: [Good] True
evalCallback: blue_ice


Loading Data: ./data/evaluate/apache_eval_log.txt Type: alf Version: 1.0 Reset: True
Resetting rows:
Loaded 447 rows from this data file.
CleanCount: 0 RowCount: 446 RowsFound: 446
Found feature type: blue_ice_log_reg


Generating Feature Data: Type: blue_ice_log_reg
Loaded 446 rows from this data file.
Cleaning row data...
CleanCount: 0 RowCount: 446 RowsFound: 446
Row0: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/db/
Row1: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/web/
Row2: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/pMA/
Row3: Hack False 82.215.181.38 http://54.82.184.132:80/sql/phpmanager/
Row4: Hack False 82.215.181.38 http://54.82.184.132:80/sql/php-myadmin/
Row5: Hack False 82.215.181.38 http://54.82.184.132:80/sql/phpmy-admin/
Row6: Hack False 82.215.181.38 http://54.82.184.132:80/sql/sql/
Row7: Hack False 82.215.181.38 http://54.82.184.132:80/sql/myadmin/
Row8: Hack False 82.215.181.38 http://54.82.184.132:80/sql/webadmin/
Row9: Hack False 82.215.181.38 http://54.82.184.132:80/sql/sqlweb/
Row10: Hack False 82.215.181.38 http://54.82.184.132:80/sql/websql/
Row11: Hack False 82.215.181.38 http://54.82.184.132:80/sql/webdb/
Row12: Hack False 82.215.181.38 http://54.82.184.132:80/sql/sqladmin/
Row13: Hack False 82.215.181.38 http://54.82.184.132:80/sql/sql-admin/
Row14: Hack False 82.215.181.38 http://54.82.184.132:80/sql/phpmyadmin2/
Row15: Hack False 82.215.181.38 http://54.82.184.132:80/sql/phpMyAdmin2/
Row16: Hack False 82.215.181.38 http://54.82.184.132:80/sql/phpMyAdmin/
Row17: Hack False 82.215.181.38 http://54.82.184.132:80/db/myadmin/
Row18: Hack False 82.215.181.38 http://54.82.184.132:80/db/webadmin/
Row19: Hack False 82.215.181.38 http://54.82.184.132:80/db/dbweb/
Row20: Hack False 82.215.181.38 http://54.82.184.132:80/db/websql/
Row21: Hack False 82.215.181.38 http://54.82.184.132:80/db/webdb/
Row22: Hack False 82.215.181.38 http://54.82.184.132:80/db/dbadmin/
Row23: Hack False 82.215.181.38 http://54.82.184.132:80/db/db-admin/
Row24: Hack False 82.215.181.38 http://54.82.184.132:80/db/phpmyadmin3/
Row25: Hack False 82.215.181.38 http://54.82.184.132:80/db/phpMyAdmin3/
Row26: Hack False 82.215.181.38 http://54.82.184.132:80/db/phpMyAdmin-3/
Row27: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/phpmyadmin/
Row28: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/phpMyAdmin/
Row29: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/db/
Row30: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/web/
Row31: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/pma/
Row32: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/PMA/
Row33: Hack False 82.215.181.38 http://54.82.184.132:80/administrator/admin/
Row34: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyAdmin2/
Row35: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyAdmin3/
Row36: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyAdmin4/
Row37: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyAdmin-3/
Row38: Hack False 82.215.181.38 http://54.82.184.132:80/php-my-admin/
Row39: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2011/
Row40: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2012/
Row41: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2013/
Row42: Hack False 89.135.131.118 http://54.82.184.132:80/database/
Row43: Hack False 89.135.131.118 http://54.82.184.132:80/db/phpmyadmin/
Row44: Hack False 89.135.131.118 http://54.82.184.132:80/db/phpMyAdmin/
Row45: Hack False 89.135.131.118 http://54.82.184.132:80/sqlmanager/
Row46: Hack False 89.135.131.118 http://54.82.184.132:80/mysqlmanager/
Row47: Hack False 89.135.131.118 http://54.82.184.132:80/php-myadmin/
Row48: Hack False 89.135.131.118 http://54.82.184.132:80/phpmy-admin/
Row49: Hack False 89.135.131.118 http://54.82.184.132:80/mysqladmin/
Row50: Hack False 89.135.131.118 http://54.82.184.132:80/mysql-admin/
Row51: Hack False 89.135.131.118 http://54.82.184.132:80/admin/phpmyadmin/
Row52: Hack False 89.135.131.118 http://54.82.184.132:80/admin/phpMyAdmin/
Row53: Hack False 89.135.131.118 http://54.82.184.132:80/admin/sysadmin/
Row54: Hack False 89.135.131.118 http://54.82.184.132:80/admin/sqladmin/
Row55: Hack False 89.135.131.118 http://54.82.184.132:80/admin/db/
Row56: Hack False 89.135.131.118 http://54.82.184.132:80/admin/web/
Row57: Hack False 89.135.131.118 http://54.82.184.132:80/admin/pMA/
Row58: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/pma/
Row59: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/db/
Row60: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/web/
Row61: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/pMA/
Row62: Hack False 89.135.131.118 http://54.82.184.132:80/sql/phpmanager/
Row63: Hack False 89.135.131.118 http://54.82.184.132:80/sql/php-myadmin/
Row64: Hack False 89.135.131.118 http://54.82.184.132:80/sql/phpmy-admin/
Row65: Hack False 89.135.131.118 http://54.82.184.132:80/sql/sql/
Row66: Hack False 89.135.131.118 http://54.82.184.132:80/sql/myadmin/
Row67: Hack False 89.135.131.118 http://54.82.184.132:80/sql/webadmin/
Row68: Hack False 89.135.131.118 http://54.82.184.132:80/sql/sqlweb/
Row69: Hack False 89.135.131.118 http://54.82.184.132:80/sql/websql/
Row70: Hack False 89.135.131.118 http://54.82.184.132:80/sql/webdb/
Row71: Hack False 89.135.131.118 http://54.82.184.132:80/sql/sqladmin/
Row72: Hack False 89.135.131.118 http://54.82.184.132:80/sql/sql-admin/
Row73: Hack False 89.135.131.118 http://54.82.184.132:80/sql/phpmyadmin2/
Row74: Hack False 89.135.131.118 http://54.82.184.132:80/sql/phpMyAdmin2/
Row75: Hack False 89.135.131.118 http://54.82.184.132:80/sql/phpMyAdmin/
Row76: Hack False 89.135.131.118 http://54.82.184.132:80/db/myadmin/
Row77: Hack False 89.135.131.118 http://54.82.184.132:80/db/webadmin/
Row78: Hack False 89.135.131.118 http://54.82.184.132:80/db/dbweb/
Row79: Hack False 89.135.131.118 http://54.82.184.132:80/db/websql/
Row80: Hack False 89.135.131.118 http://54.82.184.132:80/db/webdb/
Row81: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2014/
Row82: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2015/
Row83: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2016/
Row84: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2017/
Row85: Hack False 82.215.181.38 http://54.82.184.132:80/PMA2018/
Row86: Hack False 82.215.181.38 http://54.82.184.132:80/pma2011/
Row87: Hack False 82.215.181.38 http://54.82.184.132:80/pma2012/
Row88: Hack False 82.215.181.38 http://54.82.184.132:80/pma2013/
Row89: Hack False 82.215.181.38 http://54.82.184.132:80/pma2014/
Row90: Hack False 82.215.181.38 http://54.82.184.132:80/pma2015/
Row91: Hack False 82.215.181.38 http://54.82.184.132:80/pma2016/
Row92: Hack False 82.215.181.38 http://54.82.184.132:80/pma2017/
Row93: Hack False 82.215.181.38 http://54.82.184.132:80/pma2018/
Row94: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2011/
Row95: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2012/
Row96: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2013/
Row97: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2014/
Row98: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2015/
Row99: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2017/
Row100: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2018/
Row101: Hack False 82.215.181.38 http://54.82.184.132:80/phpmanager/
Row102: Hack False 45.32.60.183 /login.aspx
Row103: Hack False 124.206.180.130 /
Row104: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/admin/
Row105: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/dbadmin/
Row106: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/sqlmanager/
Row107: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/mysqlmanager/
Row108: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin/
Row109: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyadmin/
Row110: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyAdmin/
Row111: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyAdmin/
Row112: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2/
Row113: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin3/
Row114: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin4/
Row115: Hack False 66.135.19.5 http://54.82.184.132:80/2phpmyadmin/
Row116: Hack False 66.135.19.5 http://54.82.184.132:80/phpmy/
Row117: Hack False 89.135.131.118 http://54.82.184.132:80/db/dbadmin/
Row118: Hack False 89.135.131.118 http://54.82.184.132:80/db/db-admin/
Row119: Hack False 89.135.131.118 http://54.82.184.132:80/db/phpmyadmin3/
Row120: Hack False 89.135.131.118 http://54.82.184.132:80/db/phpMyAdmin3/
Row121: Hack False 89.135.131.118 http://54.82.184.132:80/db/phpMyAdmin-3/
Row122: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/phpmyadmin/
Row123: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/phpMyAdmin/
Row124: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/db/
Row125: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/web/
Row126: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/pma/
Row127: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/PMA/
Row128: Hack False 89.135.131.118 http://54.82.184.132:80/administrator/admin/
Row129: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyAdmin2/
Row130: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyAdmin3/
Row131: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyAdmin4/
Row132: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyAdmin-3/
Row133: Hack False 89.135.131.118 http://54.82.184.132:80/php-my-admin/
Row134: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2011/
Row135: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2012/
Row136: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2013/
Row137: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2014/
Row138: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2015/
Row139: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2016/
Row140: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2017/
Row141: Hack False 89.135.131.118 http://54.82.184.132:80/PMA2018/
Row142: Hack False 89.135.131.118 http://54.82.184.132:80/pma2011/
Row143: Hack False 89.135.131.118 http://54.82.184.132:80/pma2012/
Row144: Hack False 89.135.131.118 http://54.82.184.132:80/pma2013/
Row145: Hack False 89.135.131.118 http://54.82.184.132:80/pma2014/
Row146: Hack False 89.135.131.118 http://54.82.184.132:80/pma2015/
Row147: Hack False 89.135.131.118 http://54.82.184.132:80/pma2016/
Row148: Hack False 89.135.131.118 http://54.82.184.132:80/pma2017/
Row149: Hack False 89.135.131.118 http://54.82.184.132:80/pma2018/
Row150: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2011/
Row151: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2012/
Row152: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2013/
Row153: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2014/
Row154: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2015/
Row155: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2018/
Row156: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/admin/
Row157: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/dbadmin/
Row158: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/sqlmanager/
Row159: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/mysqlmanager/
Row160: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin/
Row161: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyadmin/
Row162: Hack False 82.215.181.38 http://54.82.184.132:80/phpMyAdmin/
Row163: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyAdmin/
Row164: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin2/
Row165: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin3/
Row166: Hack False 82.215.181.38 http://54.82.184.132:80/phpmyadmin4/
Row167: Hack False 82.215.181.38 http://54.82.184.132:80/2phpmyadmin/
Row168: Hack False 82.215.181.38 http://54.82.184.132:80/phpmy/
Row169: Hack False 82.215.181.38 http://54.82.184.132:80/phppma/
Row170: Hack False 82.215.181.38 http://54.82.184.132:80/myadmin/
Row171: Hack False 82.215.181.38 http://54.82.184.132:80/shopdb/
Row172: Hack False 82.215.181.38 http://54.82.184.132:80/MyAdmin/
Row173: Hack False 82.215.181.38 http://54.82.184.132:80/program/
Row174: Hack False 82.215.181.38 http://54.82.184.132:80/PMA/
Row175: Hack False 82.215.181.38 http://54.82.184.132:80/dbadmin/
Row176: Hack False 82.215.181.38 http://54.82.184.132:80/pma/
Row177: Hack False 82.215.181.38 http://54.82.184.132:80/db/
Row178: Hack False 82.215.181.38 http://54.82.184.132:80/admin/
Row179: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/
Row180: Hack False 82.215.181.38 http://54.82.184.132:80/database/
Row181: Hack False 82.215.181.38 http://54.82.184.132:80/db/phpmyadmin/
Row182: Hack False 82.215.181.38 http://54.82.184.132:80/db/phpMyAdmin/
Row183: Hack False 82.215.181.38 http://54.82.184.132:80/sqlmanager/
Row184: Hack False 82.215.181.38 http://54.82.184.132:80/mysqlmanager/
Row185: Hack False 82.215.181.38 http://54.82.184.132:80/php-myadmin/
Row186: Hack False 82.215.181.38 http://54.82.184.132:80/phpmy-admin/
Row187: Hack False 82.215.181.38 http://54.82.184.132:80/mysqladmin/
Row188: Hack False 82.215.181.38 http://54.82.184.132:80/mysql-admin/
Row189: Hack False 82.215.181.38 http://54.82.184.132:80/admin/phpmyadmin/
Row190: Hack False 82.215.181.38 http://54.82.184.132:80/admin/phpMyAdmin/
Row191: Hack False 82.215.181.38 http://54.82.184.132:80/admin/sysadmin/
Row192: Hack False 82.215.181.38 http://54.82.184.132:80/admin/sqladmin/
Row193: Hack False 82.215.181.38 http://54.82.184.132:80/admin/db/
Row194: Hack False 82.215.181.38 http://54.82.184.132:80/admin/web/
Row195: Hack False 82.215.181.38 http://54.82.184.132:80/admin/pMA/
Row196: Hack False 82.215.181.38 http://54.82.184.132:80/mysql/pma/
Row197: Hack False 110.161.144.207 http://54.82.184.132:80/phppma/
Row198: Hack False 110.161.144.207 http://54.82.184.132:80/myadmin/
Row199: Hack False 110.161.144.207 http://54.82.184.132:80/shopdb/
Row200: Hack False 110.161.144.207 http://54.82.184.132:80/MyAdmin/
Row201: Hack False 110.161.144.207 http://54.82.184.132:80/program/
Row202: Hack False 110.161.144.207 http://54.82.184.132:80/PMA/
Row203: Hack False 110.161.144.207 http://54.82.184.132:80/dbadmin/
Row204: Hack False 110.161.144.207 http://54.82.184.132:80/pma/
Row205: Hack False 110.161.144.207 http://54.82.184.132:80/db/
Row206: Hack False 110.161.144.207 http://54.82.184.132:80/admin/
Row207: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/
Row208: Hack False 110.161.144.207 http://54.82.184.132:80/database/
Row209: Hack False 110.161.144.207 http://54.82.184.132:80/db/phpmyadmin/
Row210: Hack False 110.161.144.207 http://54.82.184.132:80/db/phpMyAdmin/
Row211: Hack False 110.161.144.207 http://54.82.184.132:80/sqlmanager/
Row212: Hack False 110.161.144.207 http://54.82.184.132:80/mysqlmanager/
Row213: Hack False 110.161.144.207 http://54.82.184.132:80/php-myadmin/
Row214: Hack False 110.161.144.207 http://54.82.184.132:80/phpmy-admin/
Row215: Hack False 110.161.144.207 http://54.82.184.132:80/mysqladmin/
Row216: Hack False 110.161.144.207 http://54.82.184.132:80/mysql-admin/
Row217: Hack False 110.161.144.207 http://54.82.184.132:80/admin/phpmyadmin/
Row218: Hack False 110.161.144.207 http://54.82.184.132:80/admin/phpMyAdmin/
Row219: Hack False 110.161.144.207 http://54.82.184.132:80/admin/sysadmin/
Row220: Hack False 110.161.144.207 http://54.82.184.132:80/admin/sqladmin/
Row221: Hack False 110.161.144.207 http://54.82.184.132:80/admin/db/
Row222: Hack False 110.161.144.207 http://54.82.184.132:80/admin/web/
Row223: Hack False 110.161.144.207 http://54.82.184.132:80/admin/pMA/
Row224: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/pma/
Row225: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/db/
Row226: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/web/
Row227: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/pMA/
Row228: Hack False 110.161.144.207 http://54.82.184.132:80/sql/phpmanager/
Row229: Hack False 110.161.144.207 http://54.82.184.132:80/sql/php-myadmin/
Row230: Hack False 110.161.144.207 http://54.82.184.132:80/sql/phpmy-admin/
Row231: Hack False 110.161.144.207 http://54.82.184.132:80/sql/sql/
Row232: Hack False 110.161.144.207 http://54.82.184.132:80/sql/myadmin/
Row233: Hack False 110.161.144.207 http://54.82.184.132:80/sql/webadmin/
Row234: Hack False 110.161.144.207 http://54.82.184.132:80/sql/sqlweb/
Row235: Hack False 110.161.144.207 http://54.82.184.132:80/sql/websql/
Row236: Hack False 110.161.144.207 http://54.82.184.132:80/sql/webdb/
Row237: Hack False 66.135.19.5 http://54.82.184.132:80/phppma/
Row238: Hack False 66.135.19.5 http://54.82.184.132:80/myadmin/
Row239: Hack False 66.135.19.5 http://54.82.184.132:80/shopdb/
Row240: Hack False 66.135.19.5 http://54.82.184.132:80/MyAdmin/
Row241: Hack False 66.135.19.5 http://54.82.184.132:80/program/
Row242: Hack False 66.135.19.5 http://54.82.184.132:80/PMA/
Row243: Hack False 66.135.19.5 http://54.82.184.132:80/dbadmin/
Row244: Hack False 66.135.19.5 http://54.82.184.132:80/pma/
Row245: Hack False 66.135.19.5 http://54.82.184.132:80/db/
Row246: Hack False 66.135.19.5 http://54.82.184.132:80/admin/
Row247: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/
Row248: Hack False 66.135.19.5 http://54.82.184.132:80/database/
Row249: Hack False 66.135.19.5 http://54.82.184.132:80/db/phpmyadmin/
Row250: Hack False 66.135.19.5 http://54.82.184.132:80/db/phpMyAdmin/
Row251: Hack False 66.135.19.5 http://54.82.184.132:80/sqlmanager/
Row252: Hack False 66.135.19.5 http://54.82.184.132:80/mysqlmanager/
Row253: Hack False 66.135.19.5 http://54.82.184.132:80/php-myadmin/
Row254: Hack False 66.135.19.5 http://54.82.184.132:80/phpmy-admin/
Row255: Hack False 66.135.19.5 http://54.82.184.132:80/mysqladmin/
Row256: Hack False 66.135.19.5 http://54.82.184.132:80/mysql-admin/
Row257: Hack False 66.135.19.5 http://54.82.184.132:80/admin/phpmyadmin/
Row258: Hack False 66.135.19.5 http://54.82.184.132:80/admin/phpMyAdmin/
Row259: Hack False 66.135.19.5 http://54.82.184.132:80/admin/sysadmin/
Row260: Hack False 66.135.19.5 http://54.82.184.132:80/admin/sqladmin/
Row261: Hack False 66.135.19.5 http://54.82.184.132:80/admin/db/
Row262: Hack False 66.135.19.5 http://54.82.184.132:80/admin/web/
Row263: Hack False 66.135.19.5 http://54.82.184.132:80/admin/pMA/
Row264: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/pma/
Row265: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/db/
Row266: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/web/
Row267: Hack False 66.135.19.5 http://54.82.184.132:80/mysql/pMA/
Row268: Hack False 66.135.19.5 http://54.82.184.132:80/sql/phpmanager/
Row269: Hack False 66.135.19.5 http://54.82.184.132:80/sql/php-myadmin/
Row270: Hack False 66.135.19.5 http://54.82.184.132:80/sql/phpmy-admin/
Row271: Hack False 66.135.19.5 http://54.82.184.132:80/sql/sql/
Row272: Hack False 66.135.19.5 http://54.82.184.132:80/sql/myadmin/
Row273: Hack False 66.135.19.5 http://54.82.184.132:80/sql/webadmin/
Row274: Hack False 66.135.19.5 http://54.82.184.132:80/sql/sqlweb/
Row275: Hack False 66.135.19.5 http://54.82.184.132:80/sql/websql/
Row276: Hack False 66.135.19.5 http://54.82.184.132:80/sql/webdb/
Row277: Hack False 66.135.19.5 http://54.82.184.132:80/sql/sqladmin/
Row278: Hack False 66.135.19.5 http://54.82.184.132:80/sql/sql-admin/
Row279: Hack False 66.135.19.5 http://54.82.184.132:80/sql/phpmyadmin2/
Row280: Hack False 66.135.19.5 http://54.82.184.132:80/sql/phpMyAdmin2/
Row281: Hack False 66.135.19.5 http://54.82.184.132:80/sql/phpMyAdmin/
Row282: Hack False 66.135.19.5 http://54.82.184.132:80/db/myadmin/
Row283: Hack False 66.135.19.5 http://54.82.184.132:80/db/webadmin/
Row284: Hack False 66.135.19.5 http://54.82.184.132:80/db/dbweb/
Row285: Hack False 66.135.19.5 http://54.82.184.132:80/db/websql/
Row286: Hack False 66.135.19.5 http://54.82.184.132:80/db/webdb/
Row287: Hack False 66.135.19.5 http://54.82.184.132:80/db/dbadmin/
Row288: Hack False 66.135.19.5 http://54.82.184.132:80/db/db-admin/
Row289: Hack False 66.135.19.5 http://54.82.184.132:80/db/phpmyadmin3/
Row290: Hack False 66.135.19.5 http://54.82.184.132:80/db/phpMyAdmin3/
Row291: Hack False 66.135.19.5 http://54.82.184.132:80/db/phpMyAdmin-3/
Row292: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/phpmyadmin/
Row293: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/phpMyAdmin/
Row294: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/db/
Row295: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/web/
Row296: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/pma/
Row297: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/PMA/
Row298: Hack False 66.135.19.5 http://54.82.184.132:80/administrator/admin/
Row299: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyAdmin2/
Row300: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyAdmin3/
Row301: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyAdmin4/
Row302: Hack False 66.135.19.5 http://54.82.184.132:80/phpMyAdmin-3/
Row303: Hack False 66.135.19.5 http://54.82.184.132:80/php-my-admin/
Row304: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2011/
Row305: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2012/
Row306: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2013/
Row307: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2014/
Row308: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2015/
Row309: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2016/
Row310: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2017/
Row311: Hack False 66.135.19.5 http://54.82.184.132:80/PMA2018/
Row312: Hack False 66.135.19.5 http://54.82.184.132:80/pma2011/
Row313: Hack False 66.135.19.5 http://54.82.184.132:80/pma2012/
Row314: Hack False 66.135.19.5 http://54.82.184.132:80/pma2013/
Row315: Hack False 66.135.19.5 http://54.82.184.132:80/pma2014/
Row316: Hack False 66.135.19.5 http://54.82.184.132:80/pma2015/
Row317: Hack False 66.135.19.5 http://54.82.184.132:80/pma2016/
Row318: Hack False 66.135.19.5 http://54.82.184.132:80/pma2017/
Row319: Hack False 66.135.19.5 http://54.82.184.132:80/pma2018/
Row320: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2011/
Row321: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2012/
Row322: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2013/
Row323: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2014/
Row324: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2015/
Row325: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2017/
Row326: Hack False 66.135.19.5 http://54.82.184.132:80/phpmyadmin2018/
Row327: Hack False 66.135.19.5 http://54.82.184.132:80/phpmanager/
Row328: Hack False 66.249.75.133 /robots.txt
Row329: Hack False 66.249.75.133 /
Row330: Hack False 185.84.137.56 /login.aspx
Row331: Hack False 45.32.60.183 /login.aspx
Row332: Hack False 168.1.128.54 /
Row333: Hack False 110.161.144.207 http://54.82.184.132:80/pma2015/
Row334: Hack False 110.161.144.207 http://54.82.184.132:80/pma2016/
Row335: Hack False 110.161.144.207 http://54.82.184.132:80/pma2017/
Row336: Hack False 110.161.144.207 http://54.82.184.132:80/pma2018/
Row337: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2011/
Row338: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2012/
Row339: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2013/
Row340: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2014/
Row341: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2015/
Row342: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2017/
Row343: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2018/
Row344: Hack False 110.161.144.207 http://54.82.184.132:80/phpmanager/
Row345: Hack False 103.78.132.3 /
Row346: Hack False 69.30.219.186 /
Row347: Hack False 65.60.144.25 /manager/html
Row348: Hack False 71.6.202.204 /
Row349: Hack False 185.84.137.56 /login.aspx
Row350: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/admin/
Row351: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/dbadmin/
Row352: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/sqlmanager/
Row353: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/mysqlmanager/
Row354: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin/
Row355: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyadmin/
Row356: Hack False 89.135.131.118 http://54.82.184.132:80/phpMyAdmin/
Row357: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyAdmin/
Row358: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin2/
Row359: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin3/
Row360: Hack False 89.135.131.118 http://54.82.184.132:80/phpmyadmin4/
Row361: Hack False 89.135.131.118 http://54.82.184.132:80/2phpmyadmin/
Row362: Hack False 89.135.131.118 http://54.82.184.132:80/phpmy/
Row363: Hack False 89.135.131.118 http://54.82.184.132:80/phppma/
Row364: Hack False 89.135.131.118 http://54.82.184.132:80/myadmin/
Row365: Hack False 89.135.131.118 http://54.82.184.132:80/shopdb/
Row366: Hack False 89.135.131.118 http://54.82.184.132:80/MyAdmin/
Row367: Hack False 89.135.131.118 http://54.82.184.132:80/program/
Row368: Hack False 89.135.131.118 http://54.82.184.132:80/PMA/
Row369: Hack False 89.135.131.118 http://54.82.184.132:80/dbadmin/
Row370: Hack False 89.135.131.118 http://54.82.184.132:80/pma/
Row371: Hack False 89.135.131.118 http://54.82.184.132:80/db/
Row372: Hack False 89.135.131.118 http://54.82.184.132:80/admin/
Row373: Hack False 89.135.131.118 http://54.82.184.132:80/mysql/
Row374: Normal Use True 198.27.85.233 /
Row375: Hack False 115.231.218.25 /manager/html
Row376: Hack False 35.154.189.116 /
Row377: Hack False 139.162.124.167 /
Row378: Hack False 189.233.243.115 /
Row379: Hack False 91.200.12.95 /wp-login.php
Row380: Hack False 91.200.12.95 //wp-login.php
Row381: Hack False 139.162.114.70 /
Row382: Hack False 141.212.122.96 /
Row383: Hack False 50.117.89.222 /
Row384: Hack False 139.162.114.70 /
Row385: Hack False 169.54.233.118 /
Row386: Hack False 169.54.233.118 /
Row387: Hack False 191.96.249.136 /phpmyadmin/scripts/setup.php
Row388: Hack False 169.54.233.118 /
Row389: Hack False 169.54.233.118 /
Row390: Normal Use True 209.126.136.4 /
Row391: Hack False 35.189.136.159 /
Row392: Normal Use True 196.52.43.52 /
Row393: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/admin/
Row394: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/dbadmin/
Row395: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/sqlmanager/
Row396: Hack False 110.161.144.207 http://54.82.184.132:80/mysql/mysqlmanager/
Row397: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin/
Row398: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyadmin/
Row399: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyAdmin/
Row400: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyAdmin/
Row401: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin2/
Row402: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin3/
Row403: Hack False 110.161.144.207 http://54.82.184.132:80/phpmyadmin4/
Row404: Hack False 110.161.144.207 http://54.82.184.132:80/2phpmyadmin/
Row405: Hack False 110.161.144.207 http://54.82.184.132:80/phpmy/
Row406: Hack False 46.17.47.89 /recordings/
Row407: Hack False 110.161.144.207 http://54.82.184.132:80/sql/sqladmin/
Row408: Hack False 110.161.144.207 http://54.82.184.132:80/sql/sql-admin/
Row409: Hack False 110.161.144.207 http://54.82.184.132:80/sql/phpmyadmin2/
Row410: Hack False 110.161.144.207 http://54.82.184.132:80/sql/phpMyAdmin2/
Row411: Hack False 110.161.144.207 http://54.82.184.132:80/sql/phpMyAdmin/
Row412: Hack False 110.161.144.207 http://54.82.184.132:80/db/myadmin/
Row413: Hack False 110.161.144.207 http://54.82.184.132:80/db/webadmin/
Row414: Hack False 110.161.144.207 http://54.82.184.132:80/db/dbweb/
Row415: Hack False 110.161.144.207 http://54.82.184.132:80/db/websql/
Row416: Hack False 110.161.144.207 http://54.82.184.132:80/db/webdb/
Row417: Hack False 110.161.144.207 http://54.82.184.132:80/db/dbadmin/
Row418: Hack False 110.161.144.207 http://54.82.184.132:80/db/db-admin/
Row419: Hack False 110.161.144.207 http://54.82.184.132:80/db/phpmyadmin3/
Row420: Hack False 110.161.144.207 http://54.82.184.132:80/db/phpMyAdmin3/
Row421: Hack False 110.161.144.207 http://54.82.184.132:80/db/phpMyAdmin-3/
Row422: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/phpmyadmin/
Row423: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/phpMyAdmin/
Row424: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/db/
Row425: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/web/
Row426: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/pma/
Row427: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/PMA/
Row428: Hack False 110.161.144.207 http://54.82.184.132:80/administrator/admin/
Row429: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyAdmin2/
Row430: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyAdmin3/
Row431: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyAdmin4/
Row432: Hack False 110.161.144.207 http://54.82.184.132:80/phpMyAdmin-3/
Row433: Hack False 110.161.144.207 http://54.82.184.132:80/php-my-admin/
Row434: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2011/
Row435: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2012/
Row436: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2013/
Row437: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2014/
Row438: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2015/
Row439: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2016/
Row440: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2017/
Row441: Hack False 110.161.144.207 http://54.82.184.132:80/PMA2018/
Row442: Hack False 110.161.144.207 http://54.82.184.132:80/pma2011/
Row443: Hack False 110.161.144.207 http://54.82.184.132:80/pma2012/
Row444: Hack False 110.161.144.207 http://54.82.184.132:80/pma2013/
Row445: Hack False 110.161.144.207 http://54.82.184.132:80/pma2014/
Found 25 attack IP addresses with 443 attacks.

>Tutorial 6: Blue Ice2: Active Server Defense Automation

Author: Brian A. Ree

Files/Resources for this Tutorial Project Files v0.4.0.7_python2.7 (PyCharm)

0: Introduction

In order to accomplish this we need to use the checkpoints feature of our code so that we can save/restore our trained tensoflow neural network to answer a series of queries for us and use its resulting inference to decide if a log entry is an attack or a valid use case.

1: RegModelLogistic Updates

First we'll take a look at the changes to our RegModelLogistic class. Let's list some of the new methods we have added along with a short description.

setCheckPointSave: Sets the row interval at which checkpoints are saved if checkpoints have been turned on.

setCheckPointOn: Sets a toggle that turns checkpoint saves on.

setCallbackMethod: Sets a callback method for custom processing with a tensorflow session.

setExeCfg: Sets a local dictionary with a reference to the execution configuration dictionary for this model run.

predict: Uses the current neural network state to predict a Y value given an X value.

predictColumn: Converts the prediction into an output category, remember we are using logistic regression to answer yes or no, our two categories in this case are yes and no.

interpretPredictColumn: Converts the predicted column into a boolean representation. We will assume category 1 means true and category 2 means false. This is controlled by the answer order in the LoadTensorData class.

One last thing to do before we move on. Let's look at our callback method code to see it in action in the RegModelLogistic class.

2: Main Updates

You'll also notice that feature generation is a little bit cleaner and supports passing in an object of extras to supplement the feature generation process in this case.

3: Callback Method for Custom Processing

Files/Resources for this Tutorial
Project Files v0.4.0.7_python2.7 (PyCharm)