CyberShield

Cybersecurity Analysis Suite

CyberShield is a lightweight, dependency-free security analysis engine written entirely in standard C. It functions as a dual-purpose utility combining a rule-based Host Intrusion Detection System (HIDS) for server log analysis with a local static Vulnerability Scanner (CVE lookup engine).

🚀 Core Functionalities

1. Log Parsing & Threat Detection Engine

The suite parses standard server access logs to isolate unique IP addresses and monitor traffic telemetry. It evaluates raw string buffers against static rule sets to identify common network attack vectors:

• Brute Force Identification: Monitors anomalous HTTP 401 Unauthorized and 403 Forbidden responses localized to system authentication endpoints (/login, /wp-login, /admin).
• Signature-Based Web Filtering: Scans URL requests against standard attack patterns to detect Cross-Site Scripting (XSS), Directory Traversal (../), and structured SQL Injection (SQLi) vectors.
• Reconnaissance Countermeasures: Aggregates multi-port endpoint access checks flagged via distinct port-probing logs to isolate active scanners.
• Anomalous Telemetry Flags: Flags unauthorized administrative panel entry (/admin returning 200 OK) triggered during non-operational time windows (00:00 - 05:00).

2. Static Vulnerability Scanner

Features a localized, internal database mapping production software versions to historical Common Vulnerabilities and Exposures (CVE) IDs. It maps target runtime environments against known vulnerabilities, reporting specific CVSS v3 severity vectors, structural exploit descriptions, and targeted mitigation patches.

---

🛠️ Data Structure Architecture

The application optimizes memory management by utilizing a hybrid data topology:

┌─────────────────────────────────────────────────────────────────┐
│                       Memory Topologies                         │
├────────────────────────────────┬────────────────────────────────┤
│ 1. Fixed Statically Allocated  │ 2. Dynamic Linked Logs         │
│    Arrays (Global State)       │    (Heap Allocation)           │
├────────────────────────────────┼────────────────────────────────┤
│ • IPTracker Table [Max: 100]   │ • ThreatNode Alert Stack       │
│ • Threat Records  [Max: 200]   │   (Pushed dynamically for      │
│ • Hardcoded CVE Database       │    runtime session monitoring) │
└────────────────────────────────┴────────────────────────────────┘
Statically Allocated Registries: Telemetry tracking (IPTracker) and threat event logs (Threat) utilize explicit contiguous memory arrays to eliminate runtime allocation bottlenecks during hot parsing loops.

Dynamic Heap-Allocated Alert Pipeline: Active threat detections spawn transient node objects linked via a runtime stack (ThreatNode*). This guarantees that alert history persists independently of underlying parsing sweeps, offering an isolated thread-safe structure for tracking real-time alerts.

gcc -O2 main.c -o cybershield -lm
(Note: The -lm flag ensures link-time optimization for standard mathematical libraries).

Running the Suite
Run the program binary:

Bash
./cybershield
Initialize sample telemetry by executing Option 6 (Generate Sample Log File).

Parse the generated telemetry map by invoking Option 1 (Analyze Server Log File).


---

### Your Next Step to Secure Today's Green Square:
1. Copy the Markdown file layout above.
2. Save it directly into your local `README.md`.
3. Stage, commit, and push using the exact one-by-one commands we practiced earlier.