scans log files for signature of attacks in the webserver or via ssh, then blocks the hacker for one month