{"id":27295753,"url":"https://github.com/voyrox/logshield","last_synced_at":"2025-06-11T16:06:10.107Z","repository":{"id":154096869,"uuid":"631471972","full_name":"Voyrox/LogShield","owner":"Voyrox","description":"LogShield is a comprehensive machine learning project that leverages the powerful TensorFlow.js to monitor and detect malicious activity in both web server access and login logs. This robust system offers a safeguard for your server, detecting and flagging suspicious behaviors to help protect against potential security breaches.","archived":false,"fork":false,"pushed_at":"2025-01-07T09:29:51.000Z","size":4448,"stargazers_count":17,"open_issues_count":0,"forks_count":3,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-06-08T18:13:04.596Z","etag":null,"topics":["ddos-protection","firewall"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"cc0-1.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Voyrox.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-04-23T05:56:31.000Z","updated_at":"2025-04-09T10:24:59.000Z","dependencies_parsed_at":null,"dependency_job_id":"f4ce7868-17d6-4cae-a543-7ea209e291b4","html_url":"https://github.com/Voyrox/LogShield","commit_stats":null,"previous_names":["voyrox/logshield","frost-lord/logshield"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/Voyrox/LogShield","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Voyrox%2FLogShield","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Voyrox%2FLogShield/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Voyrox%2FLogShield/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Voyrox%2FLogShield/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Voyrox","download_url":"https://codeload.github.com/Voyrox/LogShield/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Voyrox%2FLogShield/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259293098,"owners_count":22835539,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ddos-protection","firewall"],"created_at":"2025-04-11T23:12:33.291Z","updated_at":"2025-06-11T16:06:10.090Z","avatar_url":"https://github.com/Voyrox.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# LogShield\n\nLogShield is a comprehensive machine learning project that leverages the powerful TensorFlow.js to monitor and detect malicious activity in both web server access and login logs. This robust system offers a safeguard for your server, detecting and flagging suspicious behaviors to help protect against potential security breaches.\n\nPowered by an intricate Recurrent Neural Network (RNN) model, LogShield specializes in sequential data understanding. This allows it to comprehend the temporal dependencies in the logs and accurately identify patterns of harmful activity. This approach is especially effective for login logs, where the sequence of attempts may indicate harmful intent.\n\nBy incorporating a machine learning model, LogShield goes beyond traditional rule-based systems to offer dynamic and adaptable protection. It is designed to learn and improve over time, refining its ability to discern legitimate from malicious activity, and delivering a progressively robust defense for your web server.\n\nWhether it's protection from Distributed Denial of Service (DDoS) attacks, brute-force login attempts, or other types of malicious activity, LogShield offers a state-of-the-art, machine learning-powered solution to bolster the security of your web server.\n\n\u003cp align=\"center\"\u003e\n    \u003cimg src=\"./display.png\"\u003e\n\u003c/p\u003e\n\n## How it works\n\n# Middleware:\n\nLogShield also includes a rate limiter feature to prevent abuse of the web server by limiting the number of requests from a single IP address within a specified time period. The rate limiter uses Redis as a storage backend to keep track of the number of requests made by each IP address.\n\nThe rate limiter can be configured with the following options:\n\n. limit: the maximum number of requests allowed within the specified time period (default: 30).\n. resetInterval: the time period in milliseconds after which the request count for an IP address should be reset (default: 1 minute).\n. blockDuration: the time period in milliseconds for which requests from an IP address should be blocked after exceeding the limit (default: 2 minutes).\n. nonceLimit: the maximum number of nonces allowed within the specified time period (default: 10).\n. nonceWindow: the time period in milliseconds after which the nonce count for an IP address should be reset (default: 5 seconds).\n\nMass GET requests (3817)\n\n```powershell\nchecks.........................: 0.26%  ✓ 10        ✗ 3817\ndata_received..................: 1.8 MB 29 kB/s\ndata_sent......................: 429 kB 7.0 kB/s\nhttp_req_blocked...............: avg=56.39µs min=0s      med=0s      max=4.27ms  p(90)=0s      p(95)=0s\nhttp_req_connecting............: avg=25.97µs min=0s      med=0s      max=3.01ms  p(90)=0s      p(95)=0s\nhttp_req_duration..............: avg=12.73ms min=1.52ms  med=11.05ms max=66.48ms p(90)=23.5ms  p(95)=25.53ms\n  { expected_response:true }...: avg=61.43ms min=57.89ms med=58.89ms max=66.48ms p(90)=66.48ms p(95)=66.48ms\nhttp_req_failed................: 99.73% ✓ 3817      ✗ 10\nhttp_req_receiving.............: avg=4.34ms  min=0s      med=3.66ms  max=19.72ms p(90)=8.08ms  p(95)=10.99ms\nhttp_req_sending...............: avg=5.12µs  min=0s      med=0s      max=1ms     p(90)=0s      p(95)=0s\nhttp_req_tls_handshaking.......: avg=0s      min=0s      med=0s      max=0s      p(90)=0s      p(95)=0s\nhttp_req_waiting...............: avg=8.39ms  min=502.4µs med=7.18ms  max=65.05ms p(90)=14.49ms p(95)=19.3ms\nhttp_reqs......................: 3827   62.710117/s\niteration_duration.............: avg=1.01s   min=1s      med=1.01s   max=1.06s   p(90)=1.02s   p(95)=1.02s\niterations.....................: 3827   62.710117/s\nvus............................: 41     min=41      max=64\nvus_max........................: 64     min=64      max=64\n```\n\nBlocked 99.73% of 3817 requests\n\n## Environment Variables\n\nThe following environment variables are used in the application:\n\n| Variable            | Description                           | Example Value                                      |\n|---------------------|---------------------------------------|----------------------------------------------------|\n| SECRET              | Secret key for session encryption     | sg809psargae9pr8gaertgheho9ar8g                    |\n| DIFFICULTY          | Difficulty level for the proxy server  | 0                                                  |\n| PORT                | Port number for the proxy server       | 7000                                               |\n| TARGETURL           | URL of the target server to proxy      | http://127.0.0.1:3000                              |\n| WHITELISTED         | Whitelisted IP addresses               | 127.0.0.1                                          |\n| Redis_Username      | Username for Redis database connection | default                                            |\n| Redis_Password      | Password for Redis database connection | qVFxATVuYmGMwJRengkJYm1Z0cz9V8bi                    |\n| Redis_Host          | Host address for Redis database         | redis-15979.c21.us-east-1-3.ec2.cloud.redislabs.com |\n| Redis_Port          | Port number for Redis database          | 6000                                              |\n| Session_Time        | Session expiration time in minutes     | 30                                                 |\n| Max_Requests        | Maximum number of requests per minute  | 100000                                             |\n| Reset_Interval      | Request rate limiter reset interval (Per 1 min)   | 1                                       |\n| BlockDuration       | Duration to block IP for rate limiting (Per 1 min) | 2                                      |\n\n1. Install Node.js and the required packages by running the following command in your terminal:\n\n```\nnpm i\n```\n2. Start the script:\n```\nnpm start\n```\n\n## Installing\n\n```sh\napt-get update \u0026\u0026 apt-get upgrade -y\ncurl -fsSL https://deb.nodesource.com/setup_19.x | sudo -E bash -\napt-get install -y nodejs nginx\nmkdir -p /etc/logshield\ncd /etc/logshield\n\n# Upload the files\n\nnpm install\ncp example.env .env\n# Edit .env\nnano .env # Change all vars you want\n# Start a system process\ncp logshield.service /etc/systemd/system/logshield.service\nsystemctl enable --now logshield\n```\n\n## Updating\n\n```sh\ncd /etc/logshield\n# upload new files\ncp logshield.service /etc/systemd/system/logshield.service\nsystemctl daemon-reload\nsystemctl restart logshield\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoyrox%2Flogshield","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoyrox%2Flogshield","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoyrox%2Flogshield/lists"}