Drupal automatic "antihack" behaviour

Question

I experience some difficulties with formalizing a question for Google, so I'm going to post it here and request real human help=)

Are there any systems (modules or smth similar) in Drupal that monitor user activity and detect possible malicious actions? And react automatically?

For example, in some form, a dummy user tries a certain kind of SQL injection. Typing something like " or 1=1 -- or similar. This is obvious that this sort of data cannot be entered be accident. Drupal then detects this:"Ahah, this is going to be something like an SQL injection", then blocks the user IP for a month, for example, and logs all information about this event. Or sends an email to admin: "User @@ possibly tried to carry SQL injection while entering @@ form while doing @@ (situation description goes there) and was blocked for a month. See log at @@"

As I understand Drupal is pretty secure but it's secure in a passive way. I want to get it not only waiting for an attack and process it but also response to this attack. Or at least notify administrator of something anusual and therefore dangerous.

I hope you will understand what I want to get (not necessarily exactly what I mentioned) and extend the scope from my possibly idiotic imaginations to what is really used today.

Answer 1

I believe you're looking for the Drupal Tiny-IDS module:

Minimalist, but performant intrusion detection system that monitors Drupal for malicious activities and targets to be simple to understand and easy to use.

It attempts to detect:

• XSS (Cross Site Scripting)
• SQLi (SQL Injection)
• Code execution (Local/Remote file inclusion, etc.)

And can 'react' in a bunch of different ways:

• Log entry
• Warning message (to the malicious user)
• Mail alert
• Rules integration (which you could use to disable the user account)

I think that ticks all the boxes :)