An ML-enhanced security analysis system for PF-based firewalls that focuses on log parsing, geolocation enrichment, and threat intelligence integration. pfLogs provides structured analysis of firewall logs with plans for advanced threat detection and security recommendations.
The system efficiently processes compressed log files, enriches data with geolocation and ASN information, and stores results in structured formats for analysis and visualization.
Automated detection of port scans, DDoS attempts, brute force attacks, and anomalous traffic patterns
BLOCK 192.168.1.100 → 10.0.0.5:22 [ALERT: SSH Brute Force Detected] BLOCK 192.168.1.100 → 10.0.0.5:22 [Pattern: 50 attempts in 60s] AUTO-BAN: 192.168.1.100 [Duration: 24h] [Reason: SSH_BRUTE_FORCE]
Efficient parsing of PF firewall logs with support for compressed files
GeoIP and ASN lookup using MaxMind databases for enhanced context
Integration with threat intelligence feeds for IOC identification
Parquet file format for efficient storage and analysis of processed logs
pfLogs provides a foundation for security analysis through efficient log processing and data enrichment. Current implementation features:
The system is designed as an extensible platform for security analysis, with planned features including anomaly detection, attack classification, automated rule generation, and visualization capabilities.
High-throughput log processing with efficient parsing
Pattern matching and anomaly detection algorithms
Compressed storage with indexed search capability
pfLogs demonstrates advanced capabilities in: