Integrasi File Log dan TCPDump untuk Analisis Forensik Serangan DDoS pada Cloud

Hero Wintolo; Muh Ikhvan Ade Rosadin; Sudaryanto Sudaryanto; Haruno Sajati; Imam Riadi; Anton Yudhana

doi:10.33506/insect.v12i2.5552

Authors

Hero Wintolo Institut Teknologi Dirgantara Adisutjipto
Muh Ikhvan Ade Rosadin Institut Teknologi Dirgantara Adisujtipto
Sudaryanto Sudaryanto Institut Teknologi Dirgantara Adisujtipto
Haruno Sajati Institut Teknologi Dirgantara Adisujtipto
Imam Riadi Universitas Ahmad Dahlan
Anton Yudhana Universitas Ahmad Dahlan

DOI:

https://doi.org/10.33506/insect.v12i2.5552

Keywords:

Analisa forensik, file log, TCP Dump, DDoS, Cloud Computing

Abstract

Penelitian ini bertujuan mengembangkan analisis forensik jaringan berbasis integrasi file log server dan TCPDump untuk meningkatkan validitas serta keterlacakan bukti serangan Distributed Denial of Service (DDoS) pada lingkungan private cloud. Metode yang diterapkan adalah Knowledge Understanding Assessment Defense (KUAD) melalui tahapan Initiation, Acquisition, Execution, Mitigation, dan Disposition, dengan validasi lintas sumber berdasarkan alamat IP, waktu kejadian, tujuan akses, dan pola aktivitas. Lingkungan eksperimen menggunakan server Intel Core i5-4590 3,30 GHz dengan RAM 8 GB, Ubuntu Server 22.04, OwnCloud 10.15.2, MikroTik CCR1016-12G, Apache2, TCPDump 4.99.1, Python, MySQL, serta dua perangkat berbasis Kali Linux yang menjalankan GoldenEye untuk menghasilkan serangan DDoS berbasis HTTP. Hasil penelitian menunjukkan bahwa file log merekam 8.864 aktivitas, sedangkan TCPDump merekam 8.086 paket dari tiga alamat IP sumber. Validasi terhadap dataset menghasilkan 91% agreement berdasarkan kesesuaian atribut utama antar-sumber. Dua alamat IP menunjukkan pola distribusi yang relatif konsisten, sedangkan satu alamat IP memperlihatkan selisih pencatatan yang lebih besar akibat perbedaan karakteristik pencatatan pada lapisan aplikasi dan jaringan. Pemantauan sistem juga menunjukkan peningkatan beban CPU dan memori selama serangan. Secara umum, integrasi file log dan TCPDump dalam kerangka KUAD mampu memberikan bukti forensik yang saling menguatkan dan mendukung rekonstruksi serangan DDoS secara lebih komprehensif dibandingkan penggunaan satu sumber data.

References

[1] O. Yoachimik, J. Pacheco, and C. One, “2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack caps a year of massive DDoS assaults,” Cloud Flare .

[2] K. Kent, S. Chevalier, T. Grance, and H. Dang, “Special Publication 800-86 Guide to Integrating Forensic Techniques into Incident Response Recommendations of the National Institute of Standards and Technology,” 2006. Accessed: Aug. 18, 2026. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-86

[3] I. Riadi, S. Sunardi, and F. Tella, “Spamming Forensic Analysis Using Network Forensics Development Life Cycle Method,” INTENSIF: Jurnal Ilmiah Penelitian dan Penerapan Teknologi Sistem Informasi, vol. 6, no. 1, pp. 108–117, Feb. 2022, doi: 10.29407/intensif.v6i1.16830.

[4] H. Wintolo, I. Riadi, and A. Yudhana, “Enhancing Private Cloud Security Using Knowledge Understanding Assessment Defense Method for Distributed Denial of Service Attack Mitigation,” International Journal of Safety and Security Engineering, vol. 15, no. 11, pp. 2323–2331, Dec. 2025, doi: 10.18280/ijsse.151112.

[5] Presiden Republik Indonesia, Undang-undang Republik Indonesia Nomor 1 Tahun 2024. 22024.

[6] B. Guttman, D. R. White, and T. Walraven, “Digital Evidence Preservation Considerations for Evidence Handlers,” Sep. 2022. doi: 10.6028/NIST.IR.8387.

[7] A. R. Kunduru, “Security Concerns and Solutions for Enterprise Cloud Computing Applications,” Asian Journal of Research in Computer Science, vol. 15, no. 4, pp. 24–33, May 2023, doi: 10.9734/ajrcos/2023/v15i4327.

[8] H. Wintolo, I. Riadi, and A. Yudhana, “Intrusion Detection Analysis on Open Journal System Services Using Network Forensic Development Life Cycle Method,” SKANIKA: Sistem Komputer dan Teknik Informatika, vol. 8, no. 1, pp. 133–144, 2025, Accessed: Apr. 15, 2025. [Online]. Available: https://doi.org/10.36080/skanika.v8i1.3284

[9] A. Yudhana, I. Riadi, and B. Putra, “Analisis Kinerja Perangkat Lunak Forensic Imaging Pada Sistem Operasi Linux Menggunakan Metode Static Forensic,” INSECT, vol. 8, no. 1, 2022.

[10] I. Riadi, A. Z. Ifani, and R. S. Kusuma, “Optimization and Evaluation of Authentication System using Blockchain Technology,” Emerging Science Journal, vol. 4, no. Special issue, pp. 225–240, 2020, doi: 10.28991/esj-2021-SP1-015.

[11] A. Al-Dhaqm et al., “Digital Forensics Subdomains: The State of the Art and Future Directions,” IEEE Access, vol. 9, pp. 152476–152502, 2021, doi: 10.1109/ACCESS.2021.3124262.

[12] A. M. Alashjaee and F. Alqahtani, “Improving Digital Forensic Security: A Secure Storage Model With Authentication and Optimal Key Generation Based Encryption,” IEEE Access, vol. 12, pp. 29738–29747, 2024, doi: 10.1109/ACCESS.2024.3369604.

[13] J. Oh, S. Lee, and H. Hwang, “Forensic Recovery of File System Metadata for Digital Forensic Investigation,” IEEE Access, vol. 10, pp. 111591–111606, 2022, doi: 10.1109/ACCESS.2022.3213030.

[14] A. Azzi, G. Heilemann, D. Georg, S. A. Pawiro, T. Mart, and W. Lechner, “Impact of log file source and data frequency on accuracy of log file-based patient specific quality assurance,” Z. Med. Phys., vol. 35, no. 2, pp. 152–160, May 2025, doi: 10.1016/j.zemedi.2023.05.006.

[15] D. Wilkinson et al., “Kilovoltage triggered imaging for moderately hypofractionated prostate radiotherapy: Insights into intrafraction motion and intervention through log file analysis,” Physica Medica, vol. 134, Jun. 2025, doi: 10.1016/j.ejmp.2025.104998.

[16] H. Choi and S. Lee, “Forensic analysis of SQL server transaction log in unallocated area of file system,” Forensic Science International: Digital Investigation, vol. 46, Oct. 2023, doi: 10.1016/j.fsidi.2023.301605.

[17] V. Zeufack, D. Kim, D. Seo, and A. Lee, “An unsupervised anomaly detection framework for detecting anomalies in real time through network system’s log files analysis,” High-Confidence Computing, vol. 1, no. 2, Dec. 2021, doi: 10.1016/j.hcc.2021.100030.

[18] Y. Azizi, M. Azizi, and M. Elboukhari, “Log files Analysis Using MapReduce to Improve Security,” in Procedia Computer Science, Elsevier B.V., 2019, pp. 37–44. doi: 10.1016/j.procs.2019.01.006.

[19] S. Shitharth and D. P. Winston, “A Comparative Analysis between Two Countermeasure Techniques to Detect DDoS with Sniffers in a SCADA Network,” Procedia Technology, vol. 21, pp. 179–186, 2015, doi: 10.1016/j.protcy.2015.10.086.

[20] D. Pinto, I. Amorim, E. Maia, and I. Praça, “A review on intrusion detection datasets: tools, processes, and features,” Computer Networks, vol. 262, May 2025, doi: 10.1016/j.comnet.2025.111177.

[21] E. Degirmenci, Y. S. Kurca, I. Ozcelik, and A. Yazici, “ROSIDS23: Network intrusion detection dataset for robot operating system,” Data Brief, no. 51, 2023, doi: 10.5281/zenodo.10014434.

[22] S. A. Muntaka et al., “Mapping the invisible internet: Framework and dataset,” Data Brief, no. 63, 2025, doi: 10.5281/zenodo.15278912.

[23] H. Zhang, “Simulation of network forensics model based on wireless sensor networks and inference technology,” Measurement: Sensors, vol. 34, p. 101261, Aug. 2024, doi: 10.1016/j.measen.2024.101261.

[24] H. Wintolo, I. Riadi, and A. Yudhana, “Post Attack Mitigation on Open Journal System Services using Knowledge Understanding Assessment Defense (KUAD) Method,” Kinetik: Game Technology, Information System, Computer Network, Computing, Electronics, and Control, Oct. 2025, doi: 10.22219/kinetik.v10i4.2279.