Deteksi Intrusi pada Jaring Komputer Berdasarkan Analisa Payload Data Menggunakan Metode SVM

Nadhori, Isbat Uzzin (2009) Deteksi Intrusi pada Jaring Komputer Berdasarkan Analisa Payload Data Menggunakan Metode SVM. Masters thesis, Institut Teknologi Sepuluh Nopember.

Text 2207205003-Master_Thesis.pdf Restricted to Repository staff only Download (11MB)

Abstract

Penelitian ini terkonsentrasi pada usaha untuk melakukan deteksi dan klasifikasi intrusi yang terjadi pada jaringan komputer. Ide dasarnya adalah mencatat aktivitas lalu lintas jaringan komputer menggunakan tcpdump, selanjutnya dilakukan ekstraksi fitur dari data lalu lintas jaringan komputer berdasarkan payload data untuk melakukan identifikasi intrusi pada level aplikasi. Metode Principal Component Analysis (PCA) digunakan untuk menentukan fitur yang paling berpengaruh. Berdasarkan fitur tersebut, dilakukan klasifikasi jenis intrusi menggunakan metode Support Vector Machines (SVM). Dilakukan eksperimen berdasarkan DARPA 1999 dataset. Ekstraksi fitur dari lalu lintas jaringan berdasarkan analisis payload berhasil mendeteksi intrusi pada level aplikasi berupa serangan yang berusaha melakukan akses masuk ke sistem dari jarak jauh (Remote to Local) dan serangan yang melakukan akses ke superuser (User to Root). Metode One-Class SVM berhasil mendapatkan akurasi rata-rata di atas 80%. Metode Incremental SVM mengalami pengurangan waktu training secara signifikan ketika data training di atas 100.000 data. Metode Multiclass SVM menghasilkan akurasi sebesar 80% dari data yang diujicobakan. Berdasarkan percobaan, dapat disimpulkan bahwa metode SVM berhasil melakukan klasifikasi terhadap jenis intrusi yang ada.
=================================================================================================================================
This research focuses on detecting and classifying intrusions within a computer network. The basic idea is to log computer network traffic activity using tcpdump, and subsequently extract features from network traffic based on payload data to identify application-level intrusions. The Principal Component Analysis (PCA) method is used to determine the most influential features. Based on these features, intrusion classification is performed using Support Vector Machines (SVM). Experiments were conducted using the DARPA 1999 dataset. Payload-analysis-based feature extraction successfully detected application-level intrusions, specifically unauthorized access from a remote machine (Remote to Local) and unauthorized access to local superuser privileges (User to Root). The One-Class SVM method achieved an average accuracy rate above 80%, while Incremental SVM significantly reduced training time when handling over 100,000 training data points. The Multiclass SVM method achieved an accuracy rate of 80% on the tested data. Based on these experiments, it can be concluded that the SVM method successfully classifies the various types of intrusions.

Item Type:	Thesis (Masters)
Uncontrolled Keywords:	Oeteksi lntrusi, Payload Data, PCA, Oneclass SVM, Incremental SVM, Multiclass SVM , Intrusion detection, payload data, PCA, OneClass SVM, incremental SVM, MultiClass SVM.
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK5105.543 Routers (Computer networks)
Divisions:	Faculty of Electrical Technology > Electrical Engineering > 20101-(S2) Master Thesis
Depositing User:	magang .
Date Deposited:	29 Sep 2026 01:32
Last Modified:	29 Sep 2026 01:32
URI:	http://repository.its.ac.id/id/eprint/145000

Actions (login required)

View Item