auth.log
│
▼
Regex Parsing Engine
│
▼
Detection Engine
┌────────┼─────────┐
▼ ▼ ▼
Micro Macro Cross-IP Window Window Correlation └────────┼─────────┘ ▼ Risk Scoring ▼ Alert Generator │ │ ▼ ▼ Console alerts.log
A lightweight concurrent detection engine written in Go that identifies SSH brute-force attacks, distributed password spraying, and persistent authentication threats in real time.
Traditional tools like Fail2Ban only detect single-IP rate-based attacks. Distributed password spraying (multiple IPs, same username, low frequency) goes completely undetected.
- Classic brute force (single IP, many attempts)
- Password spraying (many IPs, same username)
- Off-hours anomaly (11pm - 5am)
- Persistent attacks via macro time window (1 hour)
- Goroutine 1: Real-time log file monitoring
- Goroutine 2: Regex-based SSH log parsing
- Detection Engine: Dual sliding window analysis
- Micro-window (60 sec): rapid burst detection
- Macro-window (1 hour): persistent attack detection
- Risk scoring (1-10) — not binary block/allow
- Alerts saved to alerts/alerts.log
| Gap | Solution |
|---|---|
| Binary detect only | Risk scoring 1-10 |
| Single-IP detection only | Cross-IP correlation |
| Misses password spraying | Cross-IP same-username tracking |
| Heavy ML models | Lightweight Go daemon |
| No time-based analysis | Dual sliding window |
Real SSH brute force simulation using Hydra v9.7 on Kali Linux 6.18 — failed authentication attempts verified in system journals.
Go, Goroutines, Channels, sync.Mutex, Regexp, bufio, os
Go was selected because its lightweight goroutines and channel-based concurrency model enable efficient real-time log monitoring with minimal memory overhead, making it suitable for security monitoring applications.
git clone https://github.com/...
cd log-sentinel-go
go build
./logsentinel