Web Application Attacks Analysis

Analyze origin web access logs and identify security threats with actionable mitigation recommendations. The analyzer supports Nginx, Apache, and IIS W3C log formats (auto-detected), extracts the real client IP from X-Forwarded-For chains, aggregates traffic across eleven analysis dimensions, detects eleven attack patterns with evidence-backed confidence levels, and renders a pure-ASCII report in text or Markdown format.

Requires Python 3 (standard library only, no third-party packages):

python3 --version

Chinese Symptom Examples

• "网站被 CC 攻击，带宽跑满" → identify attack signatures and source distribution, then give mitigation advice.
• "日志里全是扫描器请求" → classify scanning probes and count their sources.
• "登录接口被爆破" → count failed logins and their source IPs.

Module Index