Analyzing a DDOS attack with python

ddos.py

#!/usr/bin/env python
import sys
import collections
import urllib

def main(date):
    log_file = open('/var/log/auth.log', "r")
    
    #creating an array of the ip of all items which contain date and the string "Failed password"
    arr = [line.split(" ")[-4] for line in log_file if date in line and "Failed password" in line]

    print "%d unauthorized attempts recorded for %s"%(len(arr),date)
    
    #creating a dictionary from the array of item and frequency 
    z = collections.Counter(arr)
    
    for key, value in z.iteritems():
        response = urllib.urlopen('http://api.hostip.info/get_html.php?ip=%s&position=true'%key).read()
        country = response.split('Country:')[-1].split('(')[0].strip()
        if not country: country = 'Unknown Country'
        percentage = (100*value/len(arr))
        
        #we ignore the percentages < 1 and print the rest
        if percentage:
            print "| %d%% | %s | %s |"%(percentage,country,key)


if __name__ == '__main__':
    if len(sys.argv) == 1:
        print 'Please specify date \nExample usage: python ddos.py \'Apr  5\' '
    else:
        main(sys.argv[1])

'''
To view logs
cat /var/log/auth.log | grep "Apr  4" | grep "Failed password" | wc -l

To view number of logs
cat /var/log/auth.log | grep "Apr  4" | grep "Failed password" | wc -l
'''