Blue Team: Defensive Monitoring Techniques

1. Real-time Traffic Analysis

Monitor network traffic in real-time to detect anomalies:

import pyshark
import time

def analyze_traffic(interface):
    capture = pyshark.LiveCapture(interface=interface)
    for packet in capture.sniff_continuously():
        try:
            if 'IP' in packet:
                print(f"Source IP: {packet.ip.src}, Destination IP: {packet.ip.dst}")
                if hasattr(packet, 'tcp'):
                    print(f"Source Port: {packet.tcp.srcport}, Destination Port: {packet.tcp.dstport}")
                elif hasattr(packet, 'udp'):
                    print(f"Source Port: {packet.udp.srcport}, Destination Port: {packet.udp.dstport}")
        except AttributeError:
            pass

analyze_traffic('eth0')  # Replace with your network interface

2. File Access Monitoring

Monitor file access events to detect potential data breaches:

import os
import time
from watchdog.observers import Observer
from watchdog.events import FileSystemEventHandler

class FileMonitor(FileSystemEventHandler):
    def on_any_event(self, event):
        if event.is_directory:
            return
        print(f"File {event.src_path} was {event.event_type}")

def monitor_directory(path):
    event_handler = FileMonitor()
    observer = Observer()
    observer.schedule(event_handler, path, recursive=True)
    observer.start()
    try:
        while True:
            time.sleep(1)
    except KeyboardInterrupt:
        observer.stop()
    observer.join()

monitor_directory("/path/to/monitor")  # Replace with the directory you want to monitor

3. Firewall Log Analysis

Analyze firewall logs to detect potential security threats:

import re
from collections import Counter

def analyze_firewall_logs(log_file):
    ip_pattern = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}'
    blocked_ips = []

    with open(log_file, 'r') as f:
        for line in f:
            if 'BLOCK' in line:
                ip_match = re.search(ip_pattern, line)
                if ip_match:
                    blocked_ips.append(ip_match.group())
    
    ip_counts = Counter(blocked_ips)
    print("Top 10 blocked IPs:")
    for ip, count in ip_counts.most_common(10):
        print(f"{ip}: {count} times")

analyze_firewall_logs('/var/log/firewall.log')  # Replace with your firewall log file

Building a Web-Based Network Monitoring Dashboard

Create a Flask-based web application to visualize network monitoring data:

from flask import Flask, render_template
import psutil
import netifaces
import threading
import time

app = Flask(__name__)

network_data = {}

def update_network_data():
    while True:
        interfaces = netifaces.interfaces()
        for interface in interfaces:
            try:
                network_data[interface] = psutil.net_io_counters(pernic=True)[interface]
            except KeyError:
                pass
        time.sleep(1)

@app.route('/')
def index():
    return render_template('index.html', network_data=network_data)

if __name__ == '__main__':
    threading.Thread(target=update_network_data, daemon=True).start()
    app.run(debug=True)

Create an HTML template (index.html) in a ‘templates’ folder: