AuthGuard is a custom, real-time log-based Intrusion Detection System (IDS) designed to identify sshd, FTP, and HTTP brute-force attacks, distributed password spraying, and dictionary attacks. It includes a simulated logging sandbox, regex parsing engine, detection logic, firewall mitigation script, FastAPI backend, and an obsidian-themed React + Tailwind CSS dashboard.
- Real-time Parsing Engine: Monitors logs using regular expressions to extract timestamps, source IPs, usernames, status (Success/Failure), and protocols (SSH, FTP, HTTP).
- Brute-Force Detection Logic: Tracks login attempts in a sliding window to detect:
- Threshold Brute Force (5 failures from one IP in 2 minutes)
- Password Spraying (3+ IPs targeting one username in 3 minutes)
- Dictionary Attacks (5+ unique usernames targeted by one IP in 1 minute)
- Automated Response: Generates mock firewall rules for Linux
iptablesand Windows Defender, storing blocked IP states in JSON and logs. - Interactive SOC Dashboard: Real-time stats, time-series spike charts, SVG map coordinates projection of source IPs, vertical incident timeline showing breaches (successes after multiple failures), threat hunting logs table with filters, and active block panel.
- Ingestion integrations: Prepared configurations for Logstash, Elasticsearch, and Splunk.
- Python: 3.10+
- NodeJS: 18+
In the root directory:
# Create virtual environment
python -m venv .venv
# Activate and install dependencies
.\.venv\Scripts\pip install -r requirements.txt
# Run the FastAPI server
.\.venv\Scripts\python -m uvicorn backend.main:app --port 8000 --reloadIn the frontend directory:
cd frontend
npm install
npm run devAccess the dashboard at http://localhost:5173.
Run unit tests verifying the parser regexes and detection logic rules:
.\.venv\Scripts\python -m pytest tests/test_detection.py