Detect Brute-Force in Logs | Dataford Interview Questions

Given a set of network logs, write a script to identify potential brute-force attempts.

Each log is a dictionary with timestamp, source_ip, and success. Return sorted IP addresses having at least threshold failed attempts within any window_seconds interval. Logs may be unordered; successful attempts do not count.

Input: logs, threshold, and window_seconds. Output: a list of suspicious IP addresses.

Example: logs = [{"timestamp": 1, "source_ip": "10.0.0.1", "success": false}, {"timestamp": 5, "source_ip": "10.0.0.1", "success": false}], threshold = 2, window_seconds = 10 returns ["10.0.0.1"].

Constraints

1 <= len(logs) <= 5000
Each log contains an integer timestamp, a non-empty source_ip string, and a boolean success value
0 <= timestamp <= 10^9
1 <= threshold <= len(logs)
0 <= window_seconds <= 10^9
Return each suspicious IP at most once

Function Signature

def detect_brute_force(logs, threshold, window_seconds):

Your question is Detect Brute-Force in Logs. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem