← Back to projects
PERSONAL PROJECT
Log Anomaly Detector — Rule-Based Auth Log Analysis
Rule-based detection engine for authentication logs, surfacing brute-force attempts, impossible-travel logins, credential-stuffing bursts, and off-hours access — each rule a pure, unit-tested function with zero I/O.
Context
Most SOC dashboard demos display alerts that already exist somewhere else. This one generates them — reasoning over sequences of events instead of filtering pre-labeled data.
What I built
- Four independent detection rules (detection.py) as pure functions: brute force, impossible travel, credential stuffing, off-hours access
- A windowing + dedup layer so a sustained attack does not spam duplicate anomalies
- A deterministic demo scenario, anchored to a fixed time-of-day so tests never depend on real wall-clock time
- A Simulate attack traffic button replaying that scenario live from the dashboard
- 20 Pytest tests — all 4 rules unit-tested with plain event dicts, zero database or clock dependency
Verified live
1
Anomalies per rule
Each rule fires exactly once per scenario run
0 new
Dedup on replay
Re-running the scenario correctly creates zero duplicates
4
Detection rules
Brute force, impossible travel, credential stuffing, off-hours
Screenshots