Pengelompokan Notifikasi Alert Intrusion Detection System Snort Pada Bot Telegram Menggunakan Algoritma K-Means
| Main Authors: | Alfiansyah, Bagus, Syaifuddin, Syaifuddin, Risqiwati, Diah |
|---|---|
| Format: | Article info application/pdf Journal |
| Bahasa: | eng |
| Terbitan: |
Universitas Muhammadiyah Malang
, 2020
|
| Subjects: | |
| Online Access: |
http://repositor.umm.ac.id/index.php/repositor/article/view/436 http://repositor.umm.ac.id/index.php/repositor/article/view/436/55 |
Daftar Isi:
- AbstrakDengan semakin luasnya pengetahuan dan meningkatnya kejahatan internet maka dibutuhkan Intrusion Detection System (IDS) salah satunya adalah Snort yang dapat mendeteksi serangan. Dibutuhkan notifikasi serangan agar administrator tahu jika adanya serangan. Pengelompokan alert menggunakan metode K-Means untuk membagi 2 kelompok alert yaitu low dan high. Bot Telegram akan mengirimkan alert yang memiliki label high saja. Notifikasi akan muncul pada aplikasi Telegram. Dataset 4SICS digunakan untuk proses penegelompokan agar menghasilkan 2 centroid yang akan digunakan pada serangan real. Proses pengujian serangan real dilakukan selama 2 hari. Terdapat total 10352 serangan diantaranya 1096 memiliki label high dan 9256 memiliki label low serta terdapat 771 notifikasi yang dikirimkan.Persentase hasil serangan selama satu jam berdasarkan label serangan. 60,38% serangan memiliki label “high” dan 39,62% memiliki label “low”. Persentase hasil serangan selama dua hari berdasarkan label serangan. 89% serangan memiliki label “low” dan 11% memiliki label “high”.Abstract With the increasing knowledge and cybercrime, Intrusion Detection System (IDS) is needed. One of which is Snort that can detect the attack. Notification when there is attack is needed so the administrator knows. Alert clustering uses K-Means to divide 2 cluster of alerts namely “low” and “high”. Telegram Bots will send alerts that having a “high” label only. Dataset from 4SICS is used for the grouping process to produce 2 centroid that will be used in real attacks. The real attack testing process is carried out for 2 days. There were a total of 10352 attacks including 1096 having a “high” label and 9256 having a “low” label and there were 771 notifications sent. Percentage of results of one hour attack results based on attack labels was 60.38% of attacks had the label “high” and 39.62% had the label ”low”. Percentage of results of two days attack results based on attack labels was 89% of attacks had the label “low” and 11% had the label ”high”.