Searching a log file for bad guys
Last year, I wrote some command line utilities to search an IIS log file for hack attacks. The utilities are written in c#. I wrote these two utilites in about an hour, so I hard coded some stuff to look for some things that were specific to our needs. I would love to find someone with more knowledge of hack attacks and could help me expand it some. What am I looking to do with the utilities? I have no idea.
So, what do the utilities look like? They are 2 command line utilities. 1 utility looks through a log file and removes "good" requests. the second utility puts the information into a database table, aggregates the data according to ip address and request, then does a lookup to see where that ip address is coming from so that the ip address could be reported to a someone.
Anyone interested in taking a look at it and providing me some suggestions?
Wally