Some time ago, I released a first version of a tool named Scalp. The tool analyzed the Apache HTTPD logs in order to examine if there were attacks or not. The attack detection is based on the rules provided by the PHP-IDS project.

Today, I took time to finalize a bit more the Python version of Scalp. The version 0.4 can now be downloaded on the project web page.

This version includes a couple of features such as:

  • Output in HTML, XML or TEXT format
  • Specify the output directory
  • Using a random sample for scanning the log file
  • Trying to decode the potential attack vectors
  • Returning the lines that couldn't be examined

And then, with some other options that already existed in the previous versions,

  • Select a time frame
  • Select classes of potential attacks

the tool seems to approach a final version.

I won't add more into it since I want to keep it simple and quite fast (I may add optimization if I find some). Also, the C++ version is on its way and mostly done with same amount of options, the code is checkable using the google repository, but I still have to work on options and time-frame specification.

Scalp 0.4: