📊 LogShield – Security Log Analyzer & Threat Detection

LogShield is a cybersecurity-focused web application that analyzes server and application log files to identify suspicious activities, visualize security events, and generate detailed reports. Built with Python, Flask, SQLite, HTML, CSS, and JavaScript, it helps users understand log analysis and basic threat detection techniques through an intuitive dashboard.

---

🚀 Features

📂 Log Upload

• Upload .log, .txt, and .csv files.
• Validate supported file types.
• Securely store uploaded logs for analysis.

---

🔍 Log Parsing

Extracts key information such as:

• Timestamp
• IP Address
• Username (if available)
• Event Type
• HTTP Method
• Status Code
• Log Message

---

🚨 Educational Threat Detection

Analyze uploaded logs to identify:

• Multiple failed login attempts
• Possible brute-force attacks
• Repeated HTTP 401 Unauthorized responses
• Repeated HTTP 404 errors
• High request rates from a single IP
• Suspicious activity patterns

Alerts are categorized by severity:

• 🟢 Low
• 🟡 Medium
• 🔴 High

---

📊 Security Dashboard

View:

• Total Log Entries
• Total Security Alerts
• Failed Login Attempts
• Top Source IP Addresses
• Event Distribution
• Alert Severity Summary

---

📈 Interactive Charts

Visualize:

• Event Type Distribution
• Alerts by Severity
• Top Active IP Addresses
• Security Events Over Time

---

🔎 Search & Filters

Search logs by:

• IP Address
• Event Type
• Status Code
• Severity
• Date

---

📄 Report Generation

Generate downloadable reports containing:

• Security Alerts
• Summary Statistics
• Log Analysis Results

---

🛠 Technologies Used

• Python 3
• Flask
• SQLite
• Pandas
• HTML5
• CSS3
• JavaScript
• Chart.js

---

📂 Project Structure

LogShield/
│
├── app.py
├── parser.py
├── analyzer.py
├── report_generator.py
├── database.py
├── models.py
├── requirements.txt
├── README.md
│
├── templates/
│   ├── index.html
│   ├── dashboard.html
│   ├── upload.html
│   ├── logs.html
│   ├── alerts.html
│   └── reports.html
│
├── static/
│   ├── css/
│   ├── js/
│   └── images/
│
└── database.db

---

⚙️ Installation

Clone the repository:

git clone https://github.com/yourusername/LogShield.git

Navigate to the project:

cd LogShield

Install dependencies:

pip install -r requirements.txt

Run the application:

python app.py

Open your browser:

http://127.0.0.1:5000

---

🚀 How to Use

Upload Logs

Upload a supported .log, .txt, or .csv file.

Analyze

The application parses log entries and applies built-in detection rules.

Review Alerts

View detected security events along with severity levels and descriptions.

Explore Dashboard

Monitor statistics, charts, and recent activity.

Export Reports

Download CSV reports for further analysis.

---

📸 Screenshots

Add screenshots inside:

screenshots/
├── home.png
├── upload.png
├── dashboard.png
├── logs.png
├── alerts.png
└── reports.png

---

🔒 Security Features

• Log Parsing
• Threat Detection Rules
• Failed Login Analysis
• Brute-force Detection
• Event Classification
• Severity-Based Alerts
• CSV Report Export
• Responsive Dashboard

---

📈 Future Improvements

• Real-time log monitoring
• Email alert notifications
• GeoIP lookup for IP addresses
• Threat intelligence integration
• SIEM platform integration
• Machine learning anomaly detection
• User authentication
• PDF report generation
• Docker deployment
• Multi-user support

---

🎯 Learning Outcomes

This project demonstrates knowledge of:

• Security Log Analysis
• Threat Detection
• Incident Monitoring
• Data Visualization
• Flask Web Development
• SQLite Database Integration
• Cybersecurity Fundamentals

---

⚠️ Disclaimer

LogShield is intended for educational purposes and authorized security monitoring only.

Only analyze log files that you own or have explicit permission to access.

---

👨‍💻 Author

Aashish S

Bachelor of Engineering (Computer Science)

Networking & Cybersecurity Enthusiast

---

📄 License

This project is licensed under the MIT License.