Internet Forensics Framework Based-on Clustering

Internet network attacks are complicated and worth studying. The attacks include Denial of Service (DoS). DoS attacks that exploit vulnerabilities found in operating systems, network services and applications. Indicators of DoS attacks, is when legitimate users cannot access the system. This paper proposes a framework for Internet based forensic logs that aims to assist in the investigation process to reveal DoS attacks. The framework in this study consists of several steps, among others : logging into the text file and database as well as identifying an attack based on the packet header length. After the identification process, logs are grouped using k-means clustering algorithm into three levels of attack (dangerous, rather dangerous and not dangerous) based on port numbers and tcpflags of the package. Based on the test results the proposed framework can be grouped into three level attacks and found the attacker with a success rate of 89,02%, so, it can be concluded that the proposed framework can meet the goals set in this research.

@article{Riadi2013,
  title     = {Internet Forensics Framework Based-on Clustering},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {4},
  number    = {12},
  year      = {2013},
  publisher = {The Science and Information Organization},
  author    = {Imam Riadi and Jazi Eko Istiyanto and Ahmad Ashari and Subanar},
  doi       = {10.14569/IJACSA.2013.041217},
  url       = {https://doi.org/10.14569/IJACSA.2013.041217}
}