alibabacloud-web-application-attacks-analysis
Installation
SKILL.md
Web Application Attacks Analysis
Analyze origin web access logs and identify security threats with actionable mitigation recommendations. The analyzer supports Nginx, Apache, and IIS W3C log formats (auto-detected), extracts the real client IP from X-Forwarded-For chains, aggregates traffic across eleven analysis dimensions, detects eleven attack patterns with evidence-backed confidence levels, and renders a pure-ASCII report in text or Markdown format.
Requires Python 3 (standard library only, no third-party packages):
python3 --version
Module Index
| Module | Purpose | File |
|---|---|---|
| Log Parsing | Format auto-detection, Nginx/Apache/IIS patterns, real client IP extraction, standardized fields | references/log_parsing.md |
| Attack Detection | Detection thresholds, behavioral signatures, and aggregate functions behind each attack type | references/attack-detection.md |
| Report Generation | Dual-audience layout: Executive Summary up front, the 11 detail sections, and Structured Findings (JSON) at the end | references/report-generation.md |
Load references on demand. Do not read all reference files unless the task requires them.