# /etc/vector/vector.yaml
sources:
  auth_log:
    type: file
    include:
      - /var/log/auth.log
    read_from: beginning

  nginx_access:
    type: file
    include:
      - /var/log/nginx/access.log
    read_from: beginning

  nginx_error:
    type: file
    include:
      - /var/log/nginx/error.log
    read_from: beginning

  syslog:
    type: file
    include:
      - /var/log/syslog
    read_from: beginning

transforms:
  parse_auth:
    type: remap
    inputs: ["auth_log"]
    source: |
      . = parse_syslog(.message) ?? {}
      .service = "auth"
      .event_type = if has(.program) then .program else "unknown" end

  parse_nginx:
    type: remap
    inputs: ["nginx_access"]
    source: |
      . = parse_apache_log(.message) ?? {}
      .service = "nginx"
      .status_code = to_int!(.status)

  normalize:
    type: remap
    inputs: ["parse_auth", "parse_nginx"]
    source: |
      .timestamp = now()
      .host = gethostname()
      .priority = "info"

sinks:
  local_json:
    type: file
    inputs: ["normalize"]
    path: "/var/log/vps-ai-analysis/events.jsonl"
    encoding:
      codec: json

sudo systemctl enable vector
sudo systemctl start vector

#!/usr/bin/env python3
"""SSH brute force detection using sliding window."""

import json
import time
from collections import defaultdict
from datetime import datetime, timedelta

class SSHBruteForceDetector:
    def __init__(self, max_attempts=5, window_minutes=10):
        self.max_attempts = max_attempts
        self.window = timedelta(minutes=window_minutes)
        self.failed_logins = defaultdict(list)

    def analyze(self, event: dict):
        if event.get("service") != "auth":
            return None

        if "Failed password" not in event.get("message", ""):
            return None

        # Extract IP from log message
        parts = event["message"].split()
        ip = None
        for part in parts:
            if ":" in part and part.count(".") == 3:
                ip = part.split(":")[0]
                break

        if not ip:
            return None

        username = "unknown"
        for i, part in enumerate(parts):
            if part == "for" and i + 1 < len(parts):
                username = parts[i + 1]
                break

        now = datetime.now()
        self.failed_logins[ip].append(now)

        # Clean old entries
        cutoff = now - self.window
        self.failed_logins[ip] = [t for t in self.failed_logins[ip] if t > cutoff]

        if len(self.failed_logins[ip]) >= self.max_attempts:
            return {
                "type": "ssh_bruteforce",
                "severity": "high",
                "ip": ip,
                "username": username,
                "attempts": len(self.failed_logins[ip]),
                "message": f"SSH brute force detected: {len(self.failed_logins[ip])} failed attempts from {ip} for user '{username}'"
            }

        return None

class WebAnomalyDetector:
    """Detect abnormal web access patterns."""

    def __init__(self):
        self.request_counts = defaultdict(list)

    def analyze(self, event: dict):
        if event.get("service") != "nginx":
            return None

        status_code = int(event.get("status", 200))
        ip = event.get("client_ip", "unknown")
        path = event.get("request_path", "/")

        now = time.time()
        self.request_counts[ip].append(now)

        # Clean old entries (last 60 seconds)
        cutoff = now - 60
        self.request_counts[ip] = [t for t in self.request_counts[ip] if t > cutoff]

        current_rate = len(self.request_counts[ip])

        alerts = []

        # High request rate (potential DDoS/scanner)
        if current_rate > 100:
            alerts.append({
                "type": "high_request_rate",
                "severity": "medium",
                "ip": ip,
                "rate_per_minute": current_rate,
                "message": f"High request rate from {ip}: {current_rate} requests/min"
            })

        # Scanner pattern: many 404s
        if status_code == 404:
            alerts.append({
                "type": "scanner_detected",
                "severity": "low",
                "ip": ip,
                "path": path,
                "message": f"Potential scanner hit: {path} from {ip}"
            })

        # Error spike
        if status_code >= 500:
            alerts.append({
                "type": "server_error",
                "severity": "medium",
                "ip": ip,
                "status": status_code,
                "message": f"Server error {status_code} for {path} from {ip}"
            })

        return alerts

# 安装 Ollama
curl -fsSL https://ollama.com/install.sh | sh

# 拉取轻量模型（适合日志分析）
ollama pull llama3.2:3b

# 验证
ollama list

#!/usr/bin/env python3
"""LLM-powered log analysis for security events."""

import subprocess
import json
from datetime import datetime

def analyze_with_llm(events: list[dict], context: str = "") -> str:
    """Send events to local LLM for analysis."""

    # Format events for LLM
    formatted_events = []
    for event in events[-20:]:  # Last 20 events
        formatted_events.append(json.dumps(event, ensure_ascii=False))

    prompt = f"""You are a cybersecurity analyst reviewing server logs.

Context: {context}

Recent security events:
{chr(10).join(formatted_events)}

Please analyze these events and provide:
1. Threat level assessment (Low/Medium/High/Critical)
2. Attack pattern identification
3. Recommended actions
4. Whether this is a false positive

Respond in JSON format:
{{
  "threat_level": "High",
  "pattern": "SSH Brute Force",
  "confidence": 0.95,
  "actions": ["Block IP", "Review failed accounts"],
  "is_false_positive": false,
  "summary": "Multiple failed SSH login attempts detected..."
}}"""

    try:
        result = subprocess.run(
            ["ollama", "run", "llama3.2:3b", prompt],
            capture_output=True,
            text=True,
            timeout=30
        )

        if result.returncode == 0:
            # Try to parse JSON from output
            output = result.stdout.strip()
            # Find JSON block
            start = output.find("{")
            end = output.rfind("}") + 1
            if start >= 0 and end > start:
                return json.loads(output[start:end])

        return {"error": "LLM analysis failed"}

    except Exception as e:
        return {"error": str(e)}


def main():
    # Read recent events
    events = []
    try:
        with open("/var/log/vps-ai-analysis/events.jsonl", "r") as f:
            lines = f.readlines()[-50:]  # Last 50 events
            for line in lines:
                events.append(json.loads(line.strip()))
    except FileNotFoundError:
        print("No events file found")
        return

    # Filter security-relevant events
    security_events = [
        e for e in events
        if any(keyword in json.dumps(e) for keyword in [
            "Failed", "Invalid", "error", "404", "403", "500",
            "attack", "denied", "refused"
        ])
    ]

    if not security_events:
        print("No security events detected")
        return

    analysis = analyze_with_llm(security_events)
    print(json.dumps(analysis, indent=2, ensure_ascii=False))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Smart alert system with Telegram integration."""

import requests
import json
from datetime import datetime

TELEGRAM_BOT_TOKEN = "YOUR_BOT_TOKEN"
CHAT_ID = "YOUR_CHAT_ID"

def send_telegram_alert(alert: dict):
    """Send formatted alert to Telegram."""

    severity_emoji = {
        "low": "🟡",
        "medium": "🟠",
        "high": "🔴",
        "critical": "🚨"
    }

    emoji = severity_emoji.get(alert.get("severity", "medium"), "🟠")

    message = f"""{emoji} *VPS Security Alert*

*Type:* {alert.get('type', 'Unknown')}
*Severity:* {alert.get('severity', 'N/A').upper()}
*Time:* {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

{alert.get('message', '')}

{json.dumps(alert.get('details', {}), ensure_ascii=False, indent=2)}"""

    url = f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage"
    requests.post(url, json={
        "chat_id": CHAT_ID,
        "text": message,
        "parse_mode": "Markdown",
        "disable_web_page_preview": True
    })


def auto_block_ip(ip: str, reason: str):
    """Automatically block IP using iptables."""

    # Check if already blocked
    check = subprocess.run(
        ["iptables", "-L", "INPUT", "-n"],
        capture_output=True, text=True
    )

    if ip in check.stdout:
        return False

    # Add block rule
    subprocess.run([
        "iptables", "-A", "INPUT", "-s", ip, "-j", "DROP"
    ])

    # Save rule
    subprocess.run(["netfilter-persistent", "save"])

    return True


def handle_alert(alert: dict):
    """Process alert and trigger appropriate response."""

    severity = alert.get("severity", "medium")

    # Always send notification
    send_telegram_alert(alert)

    # Auto-block for high/critical threats
    if severity in ["high", "critical"]:
        ip = alert.get("ip")
        if ip:
            blocked = auto_block_ip(ip, alert.get("type"))
            if blocked:
                send_telegram_alert({
                    "type": "auto_block",
                    "severity": "high",
                    "message": f"IP {ip} automatically blocked due to {alert.get('type')}"
                })


if __name__ == "__main__":
    # Example usage
    example_alert = {
        "type": "ssh_bruteforce",
        "severity": "high",
        "ip": "192.168.1.100",
        "attempts": 15,
        "message": "SSH brute force detected: 15 failed attempts",
        "details": {"username": "root", "time_range": "10 minutes"}
    }
    handle_alert(example_alert)

#!/usr/bin/env python3
"""Generate daily AI security report."""

import json
import subprocess
from datetime import datetime, timedelta
from collections import Counter

def generate_daily_report():
    """Generate daily security report with LLM summary."""

    # Collect yesterday's events
    yesterday = datetime.now() - timedelta(days=1)
    events = []

    try:
        with open("/var/log/vps-ai-analysis/events.jsonl", "r") as f:
            for line in f:
                event = json.loads(line.strip())
                if event.get("timestamp"):
                    events.append(event)
    except FileNotFoundError:
        return "No events data available."

    # Aggregate statistics
    alert_counts = Counter()
    top_ips = Counter()
    attack_types = Counter()

    for event in events:
        if event.get("type"):
            alert_counts[event["type"]] += 1
            if event.get("ip"):
                top_ips[event["ip"]] += 1
            if event.get("category"):
                attack_types[event["category"]] += 1

    # Prepare context for LLM
    context = f"""Daily security summary for {yesterday.strftime('%Y-%m-%d')}:
- Total security events: {len(events)}
- Top alert types: {dict(alert_counts.most_common(5))}
- Top offending IPs: {dict(top_ips.most_common(5))}
- Attack categories: {dict(attack_types.most_common(5))}"""

    # Get LLM summary
    events_summary = json.dumps({
        "total": len(events),
        "by_type": dict(alert_counts),
        "top_ips": dict(top_ips.most_common(10))
    }, indent=2)

    summary = analyze_with_llm([], context=f"{context}\n\nDetailed stats:\n{events_summary}")

    report = f"""# 🛡️ Daily VPS Security Report
**Date:** {yesterday.strftime('%Y-%m-%d')}
**Generated:** {datetime.now().strftime('%H:%M:%S')}

## Summary
{summary.get('summary', 'No significant security events detected.')}

## Threat Level: {summary.get('threat_level', 'Normal')}

## Top Alerts
{chr(10).join(f"- {k}: {v}" for k, v in alert_counts.most_common(10))}

## Top Offending IPs
{chr(10).join(f"- {ip}: {count} events" for ip, count in top_ips.most_common(10))}

## Recommended Actions
{chr(10).join(f"- {action}" for action in summary.get('actions', []))}
"""

    return report


if __name__ == "__main__":
    report = generate_daily_report()
    print(report)

    # Save to file
    with open(f"/var/log/vps-ai-analysis/daily-report-{datetime.now().strftime('%Y%m%d')}.md", "w") as f:
        f.write(report)

#!/bin/bash
# deploy-ai-log-analysis.sh
# One-click deployment for AI-powered VPS log analysis

set -e

echo "🚀 Deploying AI Log Analysis System..."

# Step 1: Install dependencies
echo "📦 Installing dependencies..."
apt-get update
apt-get install -y python3-pip python3-venv curl
pip3 install requests pillow

# Step 2: Install Vector
echo "🔄 Installing Vector..."
curl -sS https://vector.dev/generic-install.sh | sh

# Step 3: Install Ollama
echo "🤖 Installing Ollama..."
curl -fsSL https://ollama.com/install.sh | sh

# Pull lightweight model
ollama pull llama3.2:3b

# Step 4: Create working directory
mkdir -p /opt/vps-ai-analysis
cd /opt/vps-ai-analysis

# Step 5: Create Python virtual environment
python3 -m venv venv
source venv/bin/activate
pip install requests

# Step 6: Copy scripts
cp -r scripts/* . 2>/dev/null || true

# Step 7: Setup systemd services
cat > /etc/systemd/system/vps-ai-analyzer.service << 'EOF'
[Unit]
Description=VPS AI Log Analyzer
After=network.target

[Service]
Type=simple
WorkingDirectory=/opt/vps-ai-analysis
ExecStart=/opt/vps-ai-analysis/venv/bin/python3 analyzer.py
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable vps-ai-analyzer
systemctl start vps-ai-analyzer

# Step 8: Setup daily report cron
echo "0 6 * * * /opt/vps-ai-analysis/venv/bin/python3 /opt/vps-ai-analysis/report.py >> /var/log/vps-ai-analysis/cron.log 2>&1" | crontab -

echo "✅ Deployment complete!"
echo ""
echo "Services:"
echo "  - Vector: sudo systemctl status vector"
echo "  - AI Analyzer: sudo systemctl status vps-ai-analyzer"
echo "  - Daily Report: crontab -l"
echo ""
echo "Logs:"
echo "  - Events: /var/log/vps-ai-analysis/events.jsonl"
echo "  - Reports: /var/log/vps-ai-analysis/daily-report-*.md"