Network Anomaly Detection Analysis using Artillery Honeypot and Wazuh SIEM

Cybercrime attacks are difficult to detect because when they occur, irresponsible parties can exploit the system or user information. The most common attack threats are malware, brute force/password cracking, information gathering, Denial of Service (DDoS), SQL Injection, and cross-site scripting. This research was conducted to design IPS Honeypot Artillery technology to improve the performance of the security system and use SIEM Wazuh as an analysis based on event logs by conducting test methods based on the most frequent attacks to block unnatural traffic through IPS Honeypot Artillery. After implementing Honeypot and Wazuh, various attacks can be detected and monitored through SIEM Wazuh so that Honeypot Artillery can mitigate them by blocking the attacking IP address. The implementation of a server-based security system using Honeypot Artileri and SIEM Wazuh has been successfully implemented, so that it can be a solution to increase security from attacks and help network administrators to find out information patterns and attack techniques that occur so that they can follow up on these attacks.