FRAMEWORK UNTUK FORENSIK INTERNET MENGGUNAKAN K-MEANS CLUSTERING DAN HORIZONTAL PARTITIONING

• Main Authors: , IMAM RIADI, , Prof. Drs. Jazi Eko Istiyanto, M.Sc., Ph.D.
• Format: Theses and Dissertations NonPeerReviewed
• Published: [Yogyakarta] : Universitas Gadjah Mada 2014
• Subjects: ETD
• Online Access: https://repository.ugm.ac.id/129514/; http://etd.ugm.ac.id/index.php?mod=penelitian_detail&sub=PenelitianDetail&act=view&typ=html&buku_id=69906
• Institution: Universitas Gadjah Mada

Internet network attacks is complicated and worth to be studied. The attacks include DoS (Denial of Service). DoS attacks exploit vulnerabilities found in operating system, network services and applications. One of Indicators of DoS attacks is attacker spends network resources, so that legitimate users cannot access the service even caused network service being down. This study proposes a framework for Internet forensik based logs to assist in the investigation process reveals DoS attacks. Framework in this study consists of several steps, among others : the storage logs into text files and databases and identification of attacks based on the length of the packet header. Normal packet header has a length of between 20 byte - 60 byte while the packet header is not normal if it has a length below 20 byte or above 60 byte. After the identification process done, logs are grouped using k-means clustering algorithm into three levels of attack (dangerous, rather dangerous and not dangerous) based on port numbers and tcpflags of the package. In addition to the improvement of database storage performance and retrieval process was done by using the log database partitions. Database partitioning is done by dividing the data logs horizontally into sections according to the number of months in a year. The framework is implemented in a machine NFAT (Network Forensic Analysis Tools). This research uses tools DoSHTTP to attack port 80 and LOIC (Low Orbit Ion Cannon) to attack the ports 80, 443, 21 and 22. Based on the results of the testing machine NFAT can classify attacks into three levels of attack and find information ASN (Autonomous System Number - a set of IP networks operated by one or more network operators) attackers. Thus, it can be concluded that the framework for the proposed Internet forensics has met the goals set in this study.