#!/usr/bin/perl
print "Content-type: text/html \n\n";

use IO::File;
use Socket;
use Fcntl;
use File::stat;
use Time::localtime;
use Time::Local;
use Chart::Graph::Gnuplot qw(gnuplot);
#use strict;
#print "STARTcur\n";
#################################################################
# $abs_start is a time, corresponding to 00:00 of current day	#
#################################################################

my ($con,$res,$start,$stop,$time,$date,$day,$month,$year,$T0,$ip,$ppp,$key,$abs_start,$K);
my ($line,$i,$minutes,$hours,$seconds,$date_time,$record,$j,$r,$mark,$m,$fl,$p,$p1,$p2,$p3,$p4,$p5,$p6,$p7);
my (@ary,@er_dis_time,@len,@nam,@LL,@LLL,@records,@tim,@file,$form_data,$tm,$pin1,$p8);
my @mons=("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec");

# Excluding requests
my @incl=(".gif",".GIF",".jpg",".ico",".css",".png","robots.txt",".crowl.","yandsearch?","robot02.rambler","robot3.rambler","robot06.rambler","robot07.rambler","robot7.rambler","robot9.rambler","robot14.rambler","spider18.yandex","spider55.yandex",".googlebot.com","crawl.baidu.com","dotnetdotcom.org","search.msn.com",".cuil.com","crawl.yahoo.net","bredband.telia.com",".us.archive.org",".naver.jp","av16570.comex.ru",".domolink.tula.net",".setooz.com","gigablast.com","78.41.98.38","78.41.98.166","94.103.89.246","spider27.picsearch","spider30.picsearch","spider23.picsearch","turbospider.yandex","spider09.yandex");

# Forbidden methods
my @forbid=('"PUT','"TRACE','"DELETE','"OPTIONS','"PROPFIND','"PATCH','"LINK','"POST','"LOCK');

my (@MMM,@NNN,@ar,@MM,@nums,@L,@Mi,@ill,@t_mark,@n_val);
my ($cur_TIME,$length,$sum_len,$n_reqt,$N_rc,$inod,$mt,$mtime,$sum,$inode,$offset);
my ($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,$atime,$ctime,$blksize,$blocks);
my ($nm,$marker,$ip_adr,$where,$where1,$il,$y1,$y2,$y3,$y4,$y5,$tm0,$tmm,$t_mid);
my ($y_max,$y_min,$delt,$mon,$mins,$secs,$dat1,$dat2,$crea_time);
my %rec=();
my %ipa=();				# IP-address hash-array for slash-attacks
my %ips=();				# IP hash-array for Illegal Methods
my %ipd=();
my $ilm=0;				# Illegal method arracks number
my $slash=0;				# Multiple slash attacks number
my $i=0;
my $k=0;
my $file_size=0;
my $dt=900;				# delta time = 15 minute
my $counter=1440/10;			# bin number
my $n_req=0;				# init record index
my $flag=0;				# Is the data in memory? (not the first request)

#################################################
# Yu. Semenov	Mar-2011			#
# Fast-current-version				#
# Delta-T = 15 minutes				#
# Script reads file:				#
# <access_log>, extracts the records    	#
# of the last 15 minutes			#
# Format:					#
# llf320041.crawl.yahoo.net - - [19/Dec/2010:04:06:56 +0300] "GET /4/7/parallel.htm HTTP/1.0" 200 17834
# and analyzes this data			#
# We need to detect all possible 		#
# attacks during this time			#
# 1 - ////; I've change to ////// 2-6-13	#
# 2 - illegal methods (@forbid)			#
#################################################

for($i=0;$i<$counter;$i++){ $tim[$i]=0;	# clear time- nums-array
			    $nums[$i]=0; 
			    }
$p="/var/log/httpd/access_log";		# input file  <access_log>

my $path_d="/var/log/httpd/";
#opendir(DIR,$path_d);

# calculate access_log file, taking the latest one

#my $n_max=0;
#@file=grep {/access_log/} readdir(DIR);
#for($i=0;$i<4;$i++)	{$LL[$i]=substr($file[$i],11);
#			if($LL[$i]>$n_max)	{$n_max=$LL[$i];
#			$m=$i;			}
#			}
#my $file_name="access_log"."-".$LL[$m];
#print "F_name=",$file_name," LL=",$LL[$m],"\n";
#closedir(DIR);
#$p=$p."-".$LL[$m];
#print "P=",$p,"\n";

open(h_point,$p) or die "Can't start tst1: $!\n";
$p3="/home/httpd/htdocs/saturn/attacks/ids/access_ctime.txt";	# The file with creation time of access_log
sysopen(Fstat, $p3, O_RDWR) or die "Can't start tst2: $!\n";	# open status-file <access_ctime.txt>
$mt=readline(Fstat);
chomp($mt);
$offset=readline(Fstat);
chomp($offset);
$crea_time=readline(Fstat);
chomp($crea_time);
close(Fstat);
print "MT=",$mt," OFF=",$offset,"\n";
sysopen(Fstat, $p3, O_RDWR|O_TRUNC) or die "Can't start tst3: $!\n";	# open status-file <access_ctime.txt>

$inode=stat($p);				#"/var/log/httpd/access_log";
$mtime=$inode->mtime;				# last update time
$file_size=$inode->size;			# get file size of access_log in bytes
#print "file-size=",$file_size,"\n";
if($file_size<200000000)	{		# Develop access_log, if its size < 200000 Kbyte
if($mtime>$crea_time)	{$offset=0;	# If last update of access_log > creation time for  access_ctime.txt
			}
#print "Create=",$crea_time," mtime=",$mtime,"\n";

$p4="/home/httpd/htdocs/saturn/attacks/ids/slash.txt";		# output file <slash.txt>
$p5="/home/httpd/htdocs/saturn/attacks/ids/il_meth.txt";        # output file <il_meth.txt>
$p1="/home/httpd/htdocs/saturn/attacks/ids/time_ds_acc.txt";	# output file <time_ds_acc.txt>
$p2="/home/httpd/htdocs/saturn/attacks/ids/req_ds_acc.txt";	# output file <req_ds_acc.txt>
$p6="/home/httpd/htdocs/saturn/attacks/ids/slash_text.txt";     # output file <slash_text.txt>
$p7="/home/httpd/htdocs/saturn/attacks/ids/il_meth_text.txt";   # output file <il_meth_text.txt>
$p8="/home/httpd/htdocs/saturn/attacks/ids/il_ip_meth.txt";	# output file <il_ip_meth.txt>
$ppp="/home/httpd/htdocs/saturn/attacks/ids/ip_atck_acc.txt";	# input file  <ip_atck_acc.txt>
sysopen(Fstext, $p6, O_RDWR|O_APPEND|O_CREAT) or die "Can't start tst6: $!\n";    # open status-file <slash_text.txt>
sysopen(Fitext, $p7, O_RDWR|O_CREAT) or die "Can't start tst7: $!\n";    # open status-file <il_meth_text.txt>
sysopen(Film, $p8, O_RDWR|O_TRUNC|O_CREAT) or die "Can't start tst8: $!\n";# open status-file <il_ip_meth.txt>
sysopen(Fip, $ppp, O_RDWR|O_TRUNC|O_CREAT) or die$!;   # open output <ip_atck_acc.txt> file

$N_rc=0;				# Record counter init
$stop=time;				# The time=secs from the epoch beginning
$start=$stop-900;			# time of 15 minutes before
$tm=localtime;
$year=($tm->year);
$month=($tm->mon);
$day=$tm->mday;
#print "Year=",$year," time=",$start,"\n";
$abs_start=timelocal(0,0,0,$day,$month,$year);	# The time corresponding to the current day beginning
#print "ABS_st=",$abs_start," cur_time=",time,"\n";

if((time-$abs_start)<$dt)	{		# $dt=900=15 min; time-$abs_start= secs from the day beginning

#################################################
# Clear the file, at a new day beginning	#
#################################################
#$offset=0;
sysopen(ptim, $p1, O_RDWR|O_CREAT|O_TRUNC|O_APPEND) or die$!;	# open output <time_ds_acc.txt> file
sysopen(pnum, $p2, O_RDWR|O_CREAT|O_TRUNC|O_APPEND) or die$!;   # open output <req_ds_acc.txt> file
#sysopen(Fip, $ppp, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die$!;	# open output <ip_atck_acc.txt> file
sysopen(Sfil, $p4, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die "Can't start tst4: $!\n";  # open output <slash.txt> file
sysopen(Ilfil, $p5, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die "Can't start tst5: $!\n"; # open output <il_meth.txt> file
sysopen(Fstext, $p6, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die "Can't start tst6: $!\n";# open status-file <slash_text.txt>
sysopen(Fitext, $p7, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die "Can't start tst7: $!\n";# open status-file <il_meth_text.txt>
#sysopen(Film, $p8, O_RDWR|O_TRUNC|O_CREAT|O_APPEND) or die "Can't start tst8: $!\n"; # open status-file <il_ip_meth.txt>
print "new-file\n";
				}
else{open(ptim, "+>> $p1>") or die$!;      # open output <time_ds_acc.txt> file
sysopen(pnum, $p2, O_RDWR|O_CREAT|O_APPEND) or die$!;   	# open output <req_ds_acc.txt> file
#sysopen(Fip, $ppp, O_RDWR|O_CREAT|O_APPEND) or die$!;		# open output <ip_atck_acc.txt> file
sysopen(Sfil, $p4, O_RDWR|O_CREAT|O_APPEND) or die "Can't start tst4: $!\n";	# open output <slash.txt> file
sysopen(Ilfil, $p5, O_RDWR|O_CREAT|O_APPEND) or die "Can't start tst5: $!\n";	# open output <il_meth.txt> file
sysopen(Fstext, $p6, O_RDWR|O_CREAT|O_APPEND) or die "Can't start tst6: $!\n";	# open status-file <slash_text.txt>
sysopen(Fitext, $p7, O_RDWR|O_CREAT|O_APPEND) or die "Can't start tst7: $!\n";	# open status-file <il_meth_text.txt>
#sysopen(Film, $p8, O_RDWR|O_CREAT|O_APPEND) or die "Can't start tst8: $!\n";	# open status-file <il_ip_meth.txt>
print "old-file\n";
	}
$con=time;			# Start of development
#print "LINE=",$line,"\n";
close(h_point);
open(h_point,$p) or die "Can't start tst1: $!\n";	# Open <access_log>
seek h_point, $offset, 0;				# $offset was calculated from <access_ctime.txt>

#########################################################
# We start to develop records of the last 10 minutes	#
#########################################################

while (!eof(h_point)) 	{ # Cycle for <access_log>-file		#############
	$line="";							    #
	$line=readline(h_point);					    #
#print "LINE=",$line,"\n";						    #
	@ar=split(//,$line);						    #
if($#ar>52)     {        # line length control 			##########  #
	$N_rc++;	 # Next record				         #  #
	@MM=split/\s+/,$line;	# MM - word array		         #  #
###################################################################      #  #
# First record in the file <access_log> is a last in time	  #      #  #
# pool-93-186-96-64.lanta-net.ru - - [22/Nov/2009:04:09:51 +0300] #      #  #
# Date-Time format: [22/Nov/2009:04:09:51 +0300]		  #      #  #
###################################################################      #  #
$date_time=substr($MM[3],1,20);	# leading [-symbol removing	         #  #
@MMM=split(/\:/,$date_time);					         #  #
if($#MMM==3){			# date terms number control ###########  #  #
	$date=$MMM[0];						      #  #  #
#if($N_rc==1)	{print " DA=",$date,"\n";}			      #  #  #
@NNN=split(/\//,$date);						      #  #  #
if(!(defined$NNN[0]))	{$NNN[0]=1;}				      #  #  #
	$day=$NNN[0];						   	 #  #
if(!(defined$NNN[1]))	{$NNN[1]=1;}				      #	 #  #
	$month=$NNN[1];						   	 #  #
for($i=0;$i<12;$i++){if($month eq $mons[$i]){$month=$i;}}	      #	 #  #
	if(!(defined$NNN[2]))	{$NNN[2]=2;}			   	 #  #
	$year=$NNN[2];						      #	 #  #
#if($N_rc==1)	{print " Y=",$year,"\n";}			   	 #  #
	$year=$year-1900;					      #	 #  #
if(!(defined$MMM[1]))	{$MMM[1]=1;}				   	 #  #
	$hours=$MMM[1];						      #	 #  #
if(!(defined$MMM[2]))	{$MMM[2]=1;}				   	 #  #
	$minutes=$MMM[2];					      #	 #  #
if(!(defined$MMM[3]))	{$MMM[3]=1;}				   	 #  #
	$seconds=$MMM[3];					      #	 #  #
$cur_TIME=timelocal($seconds,$minutes,$hours,$day,$month,$year);      #	 #  #
if($cur_TIME>(time-900))	{	# Time control 15 mins #####  #  #  #
$fl=0;					# init includings flag	   #  #  #  #
#print "Cur_TIME=",(time-$cur_TIME),"\n";			   #  #  #  #
for($i=0;$i<$#incl+1;$i++)	{	### records filtering ###  #  #	    #
		if($fl==0)	{	#################	#  #  #  #  #
		if(index($line,$incl[$i])>=0){$fl=1;}	#	#  #  #
				}	#################	#  #  #  #  #
#print "fl=",$fl," I=",$i," LL=",$line,"\n";			#  #  #
				}	#########################  #  #  #  #
if($fl==0)	{		# There is no useless includs ###  #  #
#print "F=",$fl," LLL=",$line,"\n";				#  #  #  #  #
		$records[$n_req]=$line;	# put down the record	#  #  #
		$n_req++;					#  #  #  #  #
		}		# end of IF		#########  #  #  #  #
@ar=split(//,$line);						   #  #  #  #	
$length=$#ar;			# symbols in current line	   #  #  #  #
$tim[int(($cur_TIME-$abs_start)/60)]=$tim[int(($cur_TIME-$abs_start)/60)]+$length;
$nums[int(($cur_TIME-$abs_start)/60)]++;			   #  #  #  #
}				# End of time control		  ##  #  #  #
}                   		# Control number of terms in date  ####  #  #
			}       # if for line length control #############  #
}	# end of basic WHILE			#############################
#print "Rec0=",$records[0]," Last_rec=",$records[$n_req-1],"\n";
#print "2 ", time-$con," n_req=",$n_req,"\n"; 

$offset=tell(h_point);		# Fix a current position in <access_log>
close(h_point);
print Fstat time,"\n",$offset,"\n",$mtime,"\n";	# Writing the offset into <access_ctime.txt> 
close(Fstat);

#print "Nreq=",$n_req,"\n";
for($K=0;$K<$n_req;$K++) {	# Record-array CYCLE  			#########
$line=$records[$K];								#
@L=split(/\s+/,$line);		# Select name or IP-address			#
$where=index($line,"//////");	# "//////"-attack				#
#print "WHERE=",$where,"\n";							#
if($where>0)	{$slash++;	# If there is //////	##   			#
print Fstext	$line;		# Write slash-line   	 #   			#
#print "LINE=",$line,"\n";	# in file <slash_text.txt> #   			#
		}				    ######   			#
$where1=-1;									#
$fl=0;										#
#print "Forbid=",$#forbid,"\n";							#
for($nm=0;$nm<$#forbid+1;$nm++)	{###################				#
if($fl==0)	{	#########################  #				#
$marker=index($line,$forbid[$nm]);		# Forbidden METHODS		#
#if($nm==0){print "Marker=",$marker," F-B=",$forbid[$nm],"\n";}
if(($marker>=0)&&($marker<87))	{$fl=1;	###	#  #
print "MarkeR=",$marker,"\n";		  #
if($L[0] ne "saturn.itep.ru")	{  #####  #	#  # If request is not from ITEP
$marker=index($line,"POST");	       #  #	# POST is an attack
if(($marker>=0)&&($marker<87))	{  ##  #  #	#  #
print	Fitext $line;		    #  #  #	# POST case put down
				}  ##  #  #	#  #
print Fitext $line;		       #  #	#  # other ILL-methods
$ilm++;				       #  #	# Increment illegal method attack counter
print "ILM=",$line,"\n";	}  #####  #	#  #
				}	###	#  #
		}	#########################  #
if($fl!=0){print "fl=",$fl," I=",$i," LL=",$line,"\n";}
				}###################

if($fl==1)	{$where1=1};		# if GET use ILL method
if(($where>0)||($where1>0))	{	# if  "////" or ill Method     ###
    @Mi=split/\./,$L[0];		# Name analysis	(is it IP?)	 #
    @ar=split(//,$L[0]);						 #
#print "Where=",$where," leng=",$#ar,"\n";				 #
    if($#ar<16)	{					###############	 #
    if($#Mi==3)		{		# Is it IP-address?	####  #  #  
    if($Mi[0]!~/\D/)		{	# if number	#########  #  #  #
if($Mi[0]>0 && $Mi[0]<255)	{			#####	#  #
if($Mi[1]!~/\D/)	{		# if number #####   #	#  #
if($Mi[1]>0 && $Mi[1]<255)	{		#####	#   #	#  #
if($Mi[2]!~/\D/)		{# if numbr #####   #	#   #	#  #
if($Mi[2]>0 && $Mi[2]<255)	{######		#   #	#   #
if($Mi[3]>0 && $Mi[3]<255){#####      #	 	#   #	#   #
$ipd{$L[0]}=$L[0];	       #      #	 	#   #	#   # If there is IP-address
if($where>0) {print "IPsl=",$L[0],"\n";}
#print "ip_direct=",$ipd{$L[0]},"\n";# #	 	#   #	#   #
			  }#####      #	 	#   #	#   #
    				}######	 	#   #	#   #
				}	#########   #	#   #	#  #
				}		#####	#   #	#  #
			}			#########   #	#  #
				}			#####	#  #
				}	  		#########  #  #
			}					####  #
		}					  	#######
if(exists($ipd{$L[0]}))	{####
    $ip=$ipd{$L[0]};	    #
#print "text-IP=",$ip,"\n";  #
			}####
else{		# find out if nothing in hash ###
#print "Name///=",$L[0],"\n";			#
$ip_adr= gethostbyname($L[0]);			# Get IP by name
if (defined $ip_adr) 	{	#####		#
$ip = inet_ntoa($ip_adr);	    # IP-adr with "///"
			}	#####		#
else{$ip="1.1.1.1";}				# If there is no IP for this name
    }					#########
if($where>0)	{				   ######
if(exists($ipa{$ip}))	{ # IP-hash updating ####	#	
$ipa{$ip}=$ipa{$ip}+1;				#	#
#print "ipa=",$ip," n=",$ipa{$ip},"\n";		#	#
			}		#########	#
else{$ipa{$ip}=1;}		# hash init		#
		}		# end for WHERE!=-1 #####
if($where1>0)  {        # if ill method		    #####
if(exists($ips{$ip}))   { # IP-hash updating ####       #
$ips{$ip}=$ips{$ip}+1;                          #       #
#print "ips=",$ip," n=",$ips{$ip},"\n";		#       #
                        }               #########       #
else{$ips{$ip}=1;}		# hash init		#		  #
		}		# end for WHERE1!=-1 ####		  #
			}	# IF $fl=1			###########
			}	# end of FOR cicle ############################

#print "Start=",$start," A_start=",$abs_start,"\n";
$i=0;
foreach $key (reverse sort {$ipa{$a} <=> $ipa{$b}} keys %ipa)
{
$i++;
print Fip "$key $ipa{$key}\n";	# Slash-IP <ip_atck_acc.txt>
}
$j=0;
foreach $key (reverse sort {$ips{$a} <=> $ips{$b}} keys %ips)
{
$j++;
print Film "$key $ips{$key}\n";		# Ill-Method IP-distribution
}
#print "I=",$i," J=",$j,"\n";
for($K=0;$K<10;$K++)	{
#print "K=",$K," L=",$tim[int(($start-$abs_start)/60)+$K],"\n";
    print ptim (time+$K*60)," ",$tim[int(($start-$abs_start)/60)+$K],"\n";
    print pnum (time+$K*60)," ",$nums[int(($start-$abs_start)/60)+$K],"\n";
			}
print Sfil	time," ",$slash,"\n";
print Ilfil	time," ",$ilm,"\n";
#close(AFIL);
close(Ilfil);
close(Sfil);
close(Film);
close(Fip);
close(ptim);
close(pnum);

#########################
# GnuPlot developments	#
#########################

$p="/home/httpd/htdocs/saturn/attacks/ids/slash.txt";
sysopen(AFc, $p, O_RDWR) or die$!;      #

$i=0;
while (!eof(AFc))       {               # Cycle for <slash.txt>
$line=readline(AFc);
chop($line);
@L=split/\s/,$line;
$t_mark[$i]=$L[0];
$n_val[$i]=$L[1];
#print "n_val=",$n_val[1],"\n";
if($n_val[$i]>$y_max)   {$y_max=$n_val[$i];}
if($n_val[$i]<$y_min)   {$y_min=$n_val[$i];}
$i++;
                        }
$delt=sprintf("%.5f",($y_max-$y_min)/5);
$y_min=sprintf("%.5f",$y_min);
#print "y_min=",$y_min," delt=",$delt,"\n";
$y1=int($y_min);
$y2=int($y_min+$delt);
$y3=int($y_min+(2*$delt));
$y4=int($y_min+(3*$delt));
$y5=int($y_min+(4*$delt));

#print "Slash-y1=",$y1," y2=",$y2," y3=",$y3," y4=",$y4," y5=",$y5," ymin=",$y_min,"\n";
$t_mid=$t_mark[int($i/2)];
$tm0=$t_mark[0];
$tmm=$t_mark[$i-1];
$tm=localtime($tm0);
$year=$tm->year+1900;
$mon=($tm->mon);
$mon=$mons[$mon];
$day=$tm->mday;
$secs=$tm->sec;
$hours=$tm->hour;
$mins=$tm->min;
$dat1=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "DATE1=",$dat1,"\n";
$tm=localtime($tmm);
$year=$tm->year+1900;
$mon=($tm->mon);
$mon=$mons[$mon];
$day=$tm->mday;
$secs=$tm->sec;
$hours=$tm->hour;
$mins=$tm->min;
$dat2=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "Y-max=",$y_max," tm0=",$tm0," tmm=",$tmm," mid=",$t_mid,"\n";

gnuplot({'title' => 'The last day requests ('.$dat1.' - '.$dat2.')',
        'x2-axis label' => 'time',
	'y-axis label'=> 'slash-attacks per 10 mins',
	'x-axis label' => 'time',
	'size'=>[1.0,0.4],
	'output type' => 'gif',
	'output file' => '/home/httpd/htdocs/saturn/attacks/ids/slash.gif',
	'ytics' => [$y1,$y2,$y3,$y4,$y5],
	'extra_opts' => 'set nokey',
	'uts' => [$tm0, $tmm,1,1]},
									
[{'title' => 'data1',
	'style' => 'lines',
	'type' => 'file'}, '/home/httpd/htdocs/saturn/attacks/ids/slash.txt'],
	);
close(AFc);

$p="/home/httpd/htdocs/saturn/attacks/ids/il_meth.txt";
sysopen(AFc, $p, O_RDWR) or die$!;      #
$y_max=0;
$y_min=0;
$i=0;
while (!eof(AFc))       {               # Cycle for <il_meth.txt>
$line=readline(AFc);
chop($line);
@L=split/\s/,$line;
$t_mark[$i]=$L[0];
$n_val[$i]=$L[1];
#print "n_val=",$n_val[1],"\n";
if($n_val[$i]>$y_max)   {$y_max=$n_val[$i];}
if($n_val[$i]<$y_min)   {$y_min=$n_val[$i];}
$i++;
                        }
$delt=sprintf("%.5f",($y_max-$y_min)/5);
$y_min=sprintf("%.5f",$y_min);
print "y_min=",$y_min," delt=",$delt,"\n";
$y1=int($y_min);
$y2=int($y_min+$delt);
$y3=int($y_min+(2*$delt));
$y4=int($y_min+(3*$delt));
$y5=int($y_min+(4*$delt));
			
print "ILL_meth-y1=",$y1," y2=",$y2," y3=",$y3," y4=",$y4," y5=",$y5," ymin=",$y_min,"\n";
$t_mid=$t_mark[int($i/2)];
$tm0=$t_mark[0];
$tmm=$t_mark[$i-1];
$tm=localtime($tm0);
$year=$tm->year+1900;
$mon=($tm->mon);
$mon=$mons[$mon];
$day=$tm->mday;
$secs=$tm->sec;
$hours=$tm->hour;
$mins=$tm->min;
$dat1=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "DATE1=",$dat1,"\n";
$tm=localtime($tmm);
$year=$tm->year+1900;
$mon=($tm->mon);
$mon=$mons[$mon];
$day=$tm->mday;
$secs=$tm->sec;
$hours=$tm->hour;
$mins=$tm->min;
$dat2=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "Y-max=",$y_max," tm0=",$tm0," tmm=",$tmm," mid=",$t_mid,"\n";

gnuplot({'title' => 'The last day requests ('.$dat1.' - '.$dat2.')',
    'x2-axis label' => 'time',
    'y-axis label'=> 'Ill meths reqs per 15 mins',
    'x-axis label' => 'time',
    'size'=>[1.0,0.4],
    'output type' => 'gif',
    'output file' => '/home/httpd/htdocs/saturn/attacks/ids/il_meth.gif',
    'ytics' => [$y1,$y2,$y3,$y4,$y5],
    'extra_opts' => 'set nokey',
    'uts' => [$tm0, $tmm,1,1]},
									
[{'title' => 'data1',
'style' => 'lines',
'type' => 'file'}, '/home/httpd/htdocs/saturn/attacks/ids/il_meth.txt'],
);
close(AFc);

$p="/home/httpd/htdocs/saturn/attacks/ids/req_ds_acc.txt";
sysopen(AFc, $p, O_RDWR) or die$!;      #

$i=0;
while (!eof(AFc))       {               # Cycle for <req_ds_acc.txt>
$line=readline(AFc);
chop($line);
@L=split/\s/,$line;
$t_mark[$i]=$L[0];
$n_val[$i]=$L[1];
#print "n_val=",$n_val[1],"\n";
if($n_val[$i]>$y_max)   {$y_max=$n_val[$i];}
if($n_val[$i]<$y_min)   {$y_min=$n_val[$i];}
$i++;
                        }

    $delt=sprintf("%.5f",($y_max-$y_min)/5);
    $y_min=sprintf("%.5f",$y_min);
#print "y_min=",$y_min," delt=",$delt,"\n";
    $y1=int($y_min);
    $y2=int($y_min+$delt);
    $y3=int($y_min+(2*$delt));
    $y4=int($y_min+(3*$delt));
    $y5=int($y_min+(4*$delt));
		
#print "Req_acc-y1=",$y1," y2=",$y2," y3=",$y3," y4=",$y4," y5=",$y5," ymin=",$y_min,"\n";
    $t_mid=$t_mark[int($i/2)];
    $tm0=$t_mark[0];
    $tmm=$t_mark[$i-1];
    $tm=localtime($tm0);
    $year=$tm->year+1900;
    $mon=($tm->mon);
    $mon=$mons[$mon];
    $day=$tm->mday;
    $secs=$tm->sec;
    $hours=$tm->hour;
    $mins=$tm->min;
    $dat1=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "DATE1=",$dat1,"\n";
    $tm=localtime($tmm);
    $year=$tm->year+1900;
    $mon=($tm->mon);
    $mon=$mons[$mon];
    $day=$tm->mday;
    $secs=$tm->sec;
    $hours=$tm->hour;
    $mins=$tm->min;
    $dat2=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "Y-max=",$y_max," tm0=",$tm0," tmm=",$tmm," mid=",$t_mid,"\n";

gnuplot({'title' => 'The last day requests ('.$dat1.' - '.$dat2.')',
    'x2-axis label' => 'time',
    'y-axis label'=> 'Requests per 1 min',
    'x-axis label' => 'time',
    'size'=>[1.0,0.4],
    'output type' => 'gif',
    'output file' => '/home/httpd/htdocs/saturn/attacks/ids/req_ds_acc.gif',
    'ytics' => [$y1,$y2,$y3,$y4,$y5],
    'extra_opts' => 'set nokey',
    'uts' => [$tm0, $tmm,1,1]},

[{'title' => 'data1',
    'style' => 'lines',
    'type' => 'file'}, '/home/httpd/htdocs/saturn/attacks/ids/req_ds_acc.txt'],
);
close(AFc);

$p="/home/httpd/htdocs/saturn/attacks/ids/time_ds_acc.txt";
sysopen(AFc, $p, O_RDWR) or die$!;      #

$i=0;
while (!eof(AFc))       {               # Cycle for <time_ds_acc.txt>
$line=readline(AFc);
chop($line);
@L=split/\s/,$line;
$t_mark[$i]=$L[0];
$n_val[$i]=$L[1];
#print "n_val=",$n_val[1],"\n";
if($n_val[$i]>$y_max)   {$y_max=$n_val[$i];}
if($n_val[$i]<$y_min)   {$y_min=$n_val[$i];}
$i++;
                        }
    $delt=sprintf("%.5f",($y_max-$y_min)/5);
    $y_min=sprintf("%.5f",$y_min);
#print "y_min=",$y_min," delt=",$delt,"\n";
    $y1=int($y_min);
    $y2=int($y_min+$delt);
    $y3=int($y_min+(2*$delt));
    $y4=int($y_min+(3*$delt));
    $y5=int($y_min+(4*$delt));
			
#print "Time_acc-y1=",$y1," y2=",$y2," y3=",$y3," y4=",$y4," y5=",$y5," ymin=",$y_min,"\n";
    $t_mid=$t_mark[int($i/2)];
    $tm0=$t_mark[0];
    $tmm=$t_mark[$i-1];
    $tm=localtime($tm0);
    $year=$tm->year+1900;
    $mon=($tm->mon);
    $mon=$mons[$mon];
    $day=$tm->mday;
    $secs=$tm->sec;
    $hours=$tm->hour;
    $mins=$tm->min;
    $dat1=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "DATE1=",$dat1,"\n";
    $tm=localtime($tmm);
    $year=$tm->year+1900;
    $mon=($tm->mon);
    $mon=$mons[$mon];
    $day=$tm->mday;
    $secs=$tm->sec;
    $hours=$tm->hour;
    $mins=$tm->min;
$dat2=$year."-".$mon."-".$day." ".$hours.":".$mins.":".$secs;
#print "Y-max=",$y_max," tm0=",$tm0," tmm=",$tmm," mid=",$t_mid,"\n";

gnuplot({'title' => 'The last day requests ('.$dat1.' - '.$dat2.')',
    'x2-axis label' => 'time',
    'y-axis label'=> 'bytes in requiests per min',
    'x-axis label' => 'time',
    'size'=>[1.0,0.4],
    'output type' => 'gif',
    'output file' => '/home/httpd/htdocs/saturn/attacks/ids/time_ds_acc.gif',
    'ytics' => [$y1,$y2,$y3,$y4,$y5],
    'extra_opts' => 'set nokey',
    'uts' => [$tm0, $tmm,1,1]},
				    
[{'title' => 'data1',
    'style' => 'lines',
    'type' => 'file'}, '/home/httpd/htdocs/saturn/attacks/ids/time_ds_acc.txt'],
);
close(AFc);
				    }		# close of file size test
close(Fstat);
close(h_point);
#print "Analys_atk\n";
do "/home/crontab_files/analys_atk.pl";		# subroutine call
#print "Finish2\n";
print "file-size=",$file_size,"\n";
#exit(0);

