Implementasi dan Analisa Snort dan Suricata Sebagai IDS dan IPS Untuk Mencegah Serangan DOS dan DDOS

Abstract

DOS and DDOS is one of the most widely used attacks by hackers. DDOS is an attack with multiple attackers to deplete the resources of the target until the target cannot handle the request. To prevent the above attacks can use a firewall, the function of the firewall is the first defense of the computer that filters incoming or outgoing packets with rules on the network. Firewalls filter data based on IP addresses, protocols, and ports, so if you use a firewall, you can't analyze further attacks. In this study, to prevent this attack using a system namely Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). The function of IDS is to detect unwanted traffic on a network or device, while IPS can detect and immediately fix the problem. By using IDS and IPS attacks can be analyzed more, IDS and IPS are more reliable tools than firewalls. The test was carried out in several DOS and DDOS scenarios using the Hping3 and Slowloris tools, the test results showed that from 10 attack scenarios and not attacks, snort and suricata were balanced in issuing True Positive alerts with 3 win scenarios each, for CPU usage Suricata excelled in 7 scenarios , and in HTTP Flood attacks suricata eliminate attacks faster.