Detect Brute-Force in Logs | Dataford Interview Questions

Write a program that parses log files to identify potential brute-force or credential-stuffing attacks, optimizing for memory efficiency.

Implement def detect_attacks(log_lines, window_seconds, max_failures, min_usernames):, where log_lines is an iterable of chronological strings formatted as timestamp ip username status, with status FAILED or SUCCESS. Return sorted IP addresses that have at least max_failures failed attempts or failures involving at least min_usernames distinct usernames within any inclusive time window.

Constraints

1 <= len(log_lines) <= 1,000,000
Each line contains an integer timestamp, an IP address, a username, and either FAILED or SUCCESS
log_lines is sorted by nondecreasing timestamp
1 <= window_seconds <= 10^9
1 <= max_failures <= 10^6
1 <= min_usernames <= 10^6
Return each detected IP once, in lexicographic order

Function Signature

def detect_attacks(log_lines, window_seconds, max_failures, min_usernames):

Your question is Detect Brute-Force in Logs. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.

Problem

Write a program that parses log files to identify potential brute-force or credential-stuffing attacks, optimizing for memory efficiency.

Constraints

1 <= len(log_lines) <= 1,000,000
Each line contains an integer timestamp, an IP address, a username, and either FAILED or SUCCESS
log_lines is sorted by nondecreasing timestamp
1 <= window_seconds <= 10^9
1 <= max_failures <= 10^6
1 <= min_usernames <= 10^6
Return each detected IP once, in lexicographic order

Function Signature

def detect_attacks(log_lines, window_seconds, max_failures, min_usernames):

Your question is Detect Brute-Force in Logs. Start with the requirements in the Question tab.

Run and submit as often as you like. When you're ready, talk me through your approach or go straight to the code.