log analytics system for web attack detection - SGU Repository

(1)

Ahmad Zaenal Awaludin LOG ANALYTICS SYSTEM FOR WEB ATTACK DETECTION

By

Ahmad Zaenal Awaludin

MASTER’S DEGREE in

MASTER OF INFORMATION TECHNOLOGY FACULTY OF ENGINEERING

SWISS GERMAN UNIVERSITY The Prominence Tower

Jalan Jalur Sutera Barat No. 15, Alam Sutera Tangerang, Banten 15143 - Indonesia

June 2021

(2)

Ahmad Zaenal Awaludin LOG ANALYTICS SYSTEM FOR WEB ATTACK DETECTION

By

MASTER’S DEGREE in

MASTER OF INFORMATION TECHNOLOGY FACULTY OF ENGINEERING

SWISS GERMAN UNIVERSITY The Prominence Tower

Jalan Jalur Sutera Barat No. 15, Alam Sutera Tangerang, Banten 15143 - Indonesia

Revision after Thesis Defense on 15 July 2021

(3)

STATEMENT BY THE AUTHOR

I hereby declare that this submission is my own work and to the best of my knowledge, it contains no material previously published or written by another person, nor material which to a substantial extent has been accepted for the award of any other degree or diploma at any educational institution, except where due acknowledgement is made in the thesis.

AHMAD ZAENAL AWALUDIN

_____________________________________________

Student Date

Approved by:

Dr. Charles lim, Bsc, M.Sc

_____________________________________________

Thesis Advisor Date

Kalpin Erlangga Silaen, S,Si, M.Kom

_____________________________________________

Thesis Co-Advisor Date

Dr. Maulahikmah Galinium, S.Kom., M.Sc

_____________________________________________

Dean Date

(4)

ABSTRACT

LOG ANALYTICS SYSTEM FOR WEB ATTACK DETECTION

By

Mr. Dr. Charles Lim, Bsc, M.Sc, Advisor Mr. Kalpin Erlangga Silaen, S.Si, M.Kom, Co-Advisor

SWISS GERMAN UNIVERSITY

In this digitalization era, all activities such as studying, shopping, communication, etc.

are carried out online. one of them is to use the media website. A website is very vulnerable to attacks from various groups. There were various reasons or motives for the attack. There are various reasons for this, namely for revenge, politics, or just a show of skill. Behind the ease of access to information on the internet today, there is a big danger that can lurk at any time, namely with various kinds of attacks to try to find weaknesses in the system used. This attack can result in data corruption, data loss, and misuse of data. Etc. Currently there are many web application firewall applications that can be used to protect website applications from attacks, but sometimes there are still attacks that successfully pass through the WAF, so web application damage still often occurs due to these attacks. for that in this study we try to perform analysis of various logs, namely WAF logs, web server logs, network logs, and firewall logs to detect threats or attacks on a web application.

Keywords: Web Attack Detection, Log Analysis, Web Attack Prevention. SQL Injection Detection, XSS Attack Detection, Web Application Firewall

(5)

(6)

Ahmad Zaenal Awaludin DEDICATION

I dedicate this works for my parent, my lovely wife, my son, my organization and my country, Indonesia

(7)

Ahmad Zaenal Awaludin ACKNOWLEDGEMENTS

Thanks to Allah SWT, for giving grace, guidance, permission and help so i can finished this thesis.

Thanks to my parent that always support me, and not forget thanks to my wife and my son for supporting, patience and understanding throughout the writing of this thesis.

Thanks to my advisor, Mr. Dr. Charles Lim, BSc, M.Sc and co-advisor, Mr. Kalpin Erlangga Silaen, S.Si, M.Kom. for every advice, insights and ideas

Thanks to Mr. Andrie Yuswanto, S.Kom, M.T for all his trust and support in me to be able to continue the master's degree at Swiss German University.

Thank you to Mr. Dr. Eka Budiarto, S.T, M.Sc as the Head of MIT SGU who guided and motivated us, while studying at SGU.

Thank you to Mr. Dr. Ir. Amin Soetomo, M.Sc who gave a lot of insight into knowledge in terms of governance cybersecurity.

Thank you to all the lecturers and all staff Swiss German University who were very patient in guiding us in providing explanations during our study.

Thanks to friends MIT Swiss German University batch 26 for their solidarity.

(8)

LIST OF FIGURES

Figure 1.1 Web Application Attack Statistic (ENISA Threat Landscape 2020 - Web

application attacks) ... 13

Figure 1.2 Attack method used in 2018 (Cybersecurity threatscape 2018) ... 14

Figure 1.3 Web Defacement Statistic (LAPORAN HASIL MONITORING KEAMANAN SIBER TAHUN 2020.pdf) ... 14

Figure 2.2 Web Application architecture Diagram (Iryna Deremuk, 2021) ... 21

Figure 2.3. Vulnerabilities Year by Year. ... 24

(Acunetix Web Application Vulnerability Report 2020) ... 24

Figure 2.4 Top 5 Attack by Type (Web Attack Visualization | Akamai) ... 25

Figure 2.5 Taxonomy of the latest academic researches on anomaly detection methods of web attacks and HTTP attacks (Dong et al., 2018) ... 27

Figure 3.1 Research Method Diagram ... 33

Figure 3.2 System Architecture ... 33

Figure 3.3 Web Attack Detection Research Framework ... 33

Table 4.3 Data Source ... 37

Figure 4.1 Log WAF ... 37

Figure 4.2 Log Web Server ... 37

Figure 4.3 Log Firewall ... 38

Figure 4.4 Log Log Visualization ... 38

Figure 4.6 SQLI Pattern Library ... 39

Figure 4.7 XSS Pattern Library ... 39

Figure 4.8 FLI Pattern Library ... 39

Figure 4.9 SQLI Match Pattern ... 40

Figure 4.10 Attack Detection Dashboard ... 40

Figure 4.11 SQLI Ijection command 1 ... 40

Figure 4.12 SQLI Ijection command 2 ... 41

Figure 4.13 IP Source ... 41

Figure 4.14 IP Source ... 41

Figure 4.15 Result From Crawling Url ... 42

(11)

Figure 4.16 Logstash Config ... 42

Figure 4.17 sanitization ... 43

Figure 4.18 Training Model ... 44

Figure 4.18 Dashboard Correlation ... 44

Figure 4.19 Anomaly Request ... 45

Table 4.4 type of SQL Injection Attack ... 45

Figure 4.20 UNION query based SQLIA ... 46

Figure 4.21 Time base blind SQLI ... 46

Figure 4.22 Error based SQLIA ... 46

Figure 4.23 Suspicious Number Request ... 46

Figure 4.24 Anomaly Analysis ... 47

Figure 4.27 Bypass WAF With Normalization method ... 48

Figure 4.28 Bypass WAF With Parameter Pollution ... 49

Figure 4.29 Bypass WAF With Parameter Fragmentation ... 49

Figure 4.30 Bypass WAF With Logical Request ... 49

Figure 4.32 Bypass WAF With Command ... 50

Figure 4.33 Bypass WAF With String ... 50

Figure 4.34 Bypass WAF With Case Changing ... 50

Figure 4.35 Command SQLI From Attacker ... 51

Figure 4.36 Command SQLI From Attacker ... 51

(12)

LIST OF TABLE

Table 2.1 Related Works Summary ... 29

Table 4.1 Hardware Setup ... 36

Table 4.2 Software Setup ... 36

Table 4.3 Data Source ... 37

Table 4.4 type of SQL Injection Attack ... 45

log analytics system for web attack detection - SGU Repository

STATEMENT BY THE AUTHOR

ABSTRACT

TABLE OF CONTENTS

LIST OF FIGURES

LIST OF TABLE