Mini-HIDS Lightweight Linux Host Intrusion Detection

Problem It Solves

Small Linux hosts often lack a full SIEM or EDR stack but still need early signals for SSH brute-force activity, obvious web attack payloads in access logs, and suspicious webshell files. Mini-HIDS targets VPSes, small production boxes, and personal ops nodes with a lightweight daemon that exposes auditable detection and ban actions instead of a heavyweight platform.

How It Works

It is built with the Python standard library and SQLite. Core capabilities include:
- Sliding-window tracking for failed SSH logins and automatic bans.
- Access-log parsing for suspicious URLs, paths, or payload indicators.
- Incremental webshell scanning based on file modification time.

mini_hids.py runs the background daemon, hids_core.py provides the control-plane API, and mcp_server.py exposes MCP tools such as mini_hids_status, mini_hids_get_alerts, mini_hids_ban_ip, and mini_hids_scan_webshell. Runtime settings are centralized in config.json, including TRUSTED_IPS, FIREWALL_BACKEND, and scan intervals; the blacklist persists in SQLite, and ban expiry is checked periodically.

Boundaries

It relies on local log access, filesystem visibility, and firewall permissions, so it fits single-host or server-side deployment. Ban and unban actions are privileged, so TRUSTED_IPS needs careful maintenance. Web attack and webshell detection are heuristic signals, not a substitute for multi-host correlation, kernel telemetry, or high-integrity endpoint defense.