Jurnal Teknik Informatika (JUTIF)
Vol. 4 No. 1 (2023): JUTIF Volume 4, Number 1, February 2023

ANALYSIS OF BRUTE FORCE ATTACK LOGS TOWARD NGINX WEB SERVER ON DASHBOARD IMPROVED LOG LOGGING SYSTEM USING FORENSIC INVESTIGATION METHOD

Rio Pradana Aji (Program Studi Informatika Program Magister Fakultas Teknologi Industri, Universitas Islam Indonesia)
Yudi Prayudi (Program Studi Informatika Program Magister Fakultas Teknologi Industri, Universitas Islam Indonesia)
Ahmad Luthfi (Program Studi Informatika Program Magister Fakultas Teknologi Industri, Universitas Islam Indonesia)



Article Info

Publish Date
10 Feb 2023

Abstract

Since it was first launched in 1990, the Web Server is still in use today. No exception, almost all companies entering industry 4.0 use Web Servers to show the existence of the company's website and its products. Starting from the websites provided for free by WordPress and Blogspot to independent websites created by their respective companies. The web server itself is available in several types, ranging from apache, nginx, litespeed, etc. Of course, the use of a Web Server for websites cannot be separated from internet crimes or cyber crimes. One of the crimes committed is the hacker's attempt to login to the website Administrator page. The loophole used by hackers is brute force or forced entry by trying every combination of existing Administrator User and Password. This research focuses on building and updating a website monitoring dashboard system with Wazuh technology. The method used in this study is the Quantitative Forensic Investigation Method by examining the logs generated by the System Dashboard using Digital Forensic procedures. This monitoring process aims to detect brute force threats on managed websites by showing the website Administrator login activity log. The results of the metadata log shown by the optimized dashboard show the number of brute force attacks on managed websites. The number of attacks recorded was 259646 attacks on the first cluster and 288676 attacks on the second cluster. In addition, the results of the metadata log can be investigated further to find the location of the Hacker. The location of the hackers found was only limited to the VPN (Virtual Private Network) server used. One of the VPN servers used in this case is Amazon Data Center.

Copyrights © 2023






Journal Info

Abbrev

jurnal

Publisher

Subject

Computer Science & IT

Description

Jurnal Teknik Informatika (JUTIF) is an Indonesian national journal, publishes high-quality research papers in the broad field of Informatics, Information Systems and Computer Science, which encompasses software engineering, information system development, computer systems, computer network, ...