Searching a log file for bad guys

Last year, I wrote some command line utilities to search an IIS log file for hack attacks.  The utilities are written in c#.  I wrote these two utilites in about an hour, so I hard coded some stuff to look for some things that were specific to our needs.  I would love to find someone with more knowledge of hack attacks and could help me expand it some.  What am I looking to do with the utilities?  I have no idea.

So, what do the utilities look like?  They are 2 command line utilities.  1 utility looks through a log file and removes "good" requests.  the second utility puts the information into a database table, aggregates the data according to ip address and request, then does a lookup to see where that ip address is coming from so that the ip address could be reported to a someone.

Anyone interested in taking a look at it and providing me some suggestions?

Wally

No Comments