Jul 2026· Jurnal Sains, Nalar, dan Aplikasi Teknologi Informasi· Vol 5, pp. 128-137· 0 citations· 5 references
TL;DR
The research concludes that the integration of Wazuh SIEM with the MITRE ATT&CK framework is effective in detecting and analyzing cyber attacks on Windows Server 2019, with practical contributions in the form of implementation guidelines for rule-based detection and correlation rules for multi-stage attack detection.
Abstract
Cloud infrastructure security represents a critical challenge in addressing cybersecurity threats, particularly for internet-facing services such as Remote Desktop Protocol (RDP) and SQL Server. This research investigates cloud infrastructure security based on Windows Server 2019 through the development of a proactive and responsive attack detection and analysis framework using the Wazuh platform as Security Information and Event Management (SIEM) integrated with the MITRE ATT&CK framework. The research method employs an experimental approach with continuous monitoring for 30 days of two Windows Server 2019 units running RDP and SQL Server services. Attack simulations were conducted using eight different scenarios including RDP brute force, SQL Server authentication brute force, port scanning, privilege escalation, lateral movement, data exfiltration, persistence mechanisms, and defense evasion. Monitoring results revealed 110,492 total security events, dominated by 109,057 authentication failures (98.7%) and only 171 successful authentications, with the remainder consisting of other activities such as port scanning and process execution. The Wazuh-based detection system with MITRE ATT&CK integration successfully mapped 15 attack techniques, 10 of which were actively observed during the 30-day monitoring period, with a detection rate of 93.2%, false positive rate of 6.8%, and average response time of 2.4 seconds. Compliance analysis showed 87% compliance with PCI DSS, 91% with NIST 800-53, 85% with HIPAA, and 89% with GDPR. The research concludes that the integration of Wazuh SIEM with the MITRE ATT&CK framework is effective in detecting and analyzing cyber attacks on Windows Server 2019, with practical contributions in the form of implementation guidelines for rule-based detection and correlation rules for multi-stage attack detection.
The rapid expansion of cloud computing has revolutionized IT infrastructure, offering significant
benefits in scalability, flexibility, and cost-efficiency. However, its growth has introduced critical
security challenges, particularly in the form of server-side attacks that exploit the dynamic and
multi-tenant architecture of cloud environments. Currently, existing systems are faced with
several limitations, including the difficulty in detecting and blocking server-side attacks in real
time, challenges in accurately classifying evolving attack vectors, and the inability to ensure
robust data isolation and privacy within shared infrastructures. This study developed an
adaptive server-side attack detection and blocking system suitable for cloud computing
environments. The developed system integrates a Neuro-Fuzzy Inference System (NFIS) for
intelligent detection and blocking and employs Support Vector Machine (SVM) for classifying
sophisticated and previously unseen attack traffic patterns. To uphold data isolation and
enhance privacy and security, the system incorporates the Cheon-Kim-Kim-Song (CKKS)
scheme of Homomorphic Encryption (HE), ensuring that sensitive information (both in transit
and at rest) remains secure. Furthermore, an Object-Oriented Design Approach (OODA) was
adopted for the designing and modelling of the system’s components. The implementation of the
system was achieved using Visual Basic (VB) .Net 2022 for system interactive interface
designing and coding with plugged-in Python programming language libraries for Machine
Learning (ML) task. The system utilized the Microsoft Structured Query Language (SQL)
management studio as its database server. Seven network-based traffic features were selected as
input variables to the developed system. These features are the Timestamp, Source IP,
Destination IP, Source Port, Destination Port, Protocol, and Payload data. The developed
system was trained using Backpropagation method, while the testing and performance
evaluation was achieved using the Canadian Institute for Cybersecurity Intrusion Detection
System 2017 (CICIDS2017) benchmark dataset. The developed system achieved a 99% accuracy
rate in detection, a precision of 99.5%, recall of 99.5%, and an F1-score of 99.5%. In terms of
performance in blocking malicious network traffic patterns, it recorded a True Negative Rate
(TNR) of 99.5% and a remarkably low False Positive Rate (FPR) of 0.05%. Further, in privacy
preservation, the encryption and decryption processes demonstrated average execution times of
112ms and 89ms, respectively, with a ciphertext expansion ratio of 1.5×, enabling secure
processing without compromising performance. These results affirm that the developed system
provides a robust, adaptive, and privacy-preserving solution for mitigating a broad spectrum of
server-side attacks in cloud settings.
A. O. Akanwa· International Journal of Com...· 0 citations
Virtualized infrastructure in cloud computing has become an attractive target for cyber attackers to launch advanced attacks. This paper proposes a novel big data based security analytics approach to detecting advanced attacks in virtualized infrastructures. Network logs as well as user application logs collected periodically from the guest virtual machines (VMs) are stored in the Hadoop Distributed File System (HDFS). Then, extraction of attack features is performed through graph-based event correlation and MapReduce parser based identification of potential attack paths. Next, determination of attack presence is performed through two-step machine learning, namley logistic regression is applied to calculate attack’s conditional probabilities with respect to the attributes, andbelief propagation is applied to calculate the belief in existence of an attack based on them. Experiments are conducted to evaluate the proposed approach using well-known malware as well as in comparison with existing security techniques for virtualized infrastructure. The results show that our proposed approach is effective in detecting attacks with minimal performance overhead.
Unknown authors· Journal of Science & Technol...· 0 citations
This study examines the evolving security landscape of serverless computing, specifically focusing on AWS Lambda and Google Cloud Functions. While serverless architectures offer significant scalability and cost advantages, their event-driven nature introduces unique vulnerabilities that traditional infrastructure-based security measures often fail to address. To identify these risks, a multi-methodological approach was employed, involving systematic literature mapping, platform benchmarking, and threat modeling using the STRIDE framework. The research specifically analyzed the "blast radius" of compromised functions and the efficacy of current penetration testing methodologies. Results indicate that Identity and Access Management (IAM) misconfigurations are the primary driver of cloud breaches, accounting for 42% of critical vulnerabilities, while traditional network scanning yielded zero actionable detection data. Furthermore, simulation data revealed that unthrottled "Denial-of-Wallet" attacks can cause catastrophic financial loss within minutes. Based on these findings, a five-layer defense-in-depth framework is proposed, integrating secure secret management, automated dependency scanning, and identity-centric governance. The study concludes that securing serverless environments requires a paradigm shift from network-level protection to granular application logic validation and continuous observability. These measures are essential for maintaining data integrity in decentralized cloud-native environments.
Norsyazwani Mohd Puad, Paiwand Hadi Hama Saeed, Braw Araz Mohammed et al.· Journal of Applied Computer...· 0 citations
Internet of Things (IoT) device security remains a concern due to their limited computational resources and increasing exposure to network-based cyberattacks. While recent IoT security research has focused on machine-learning and blockchain-based defense mechanisms, many of these approaches introduce computational overhead that may not be suitable for resource-constrained devices. This study investigates lightweight host-based countermeasures against network-level spoofing and phishing attacks targeting IoT environments. Specifically, the research examines attack entry points, classifies associated vulnerabilities, and evaluates three practical defense mechanisms: packet analysis using Wireshark, port monitoring using iptables, and host file reconfiguration. Detection is performed through the identification of abnormal TCP communication patterns, unauthorized port activity, and malicious-domain access attempts. A controlled experimental environment based on a Raspberry Pi IoT platform was used to assess the effectiveness and resource consumption of each approach. The results indicate that host file reconfiguration achieved the highest detection accuracy (96%) with the lowest CPU overhead (7%), while the combined deployment of all mechanisms achieved a 99% blocking success rate. The findings demonstrate that lightweight host-based defenses can provide protection against phishing and spoofing attacks while maintaining operational suitability for resource-constrained IoT devices.
Kuberan Dharmalingam, S. Yogarayan, Ang Ee Mae· International Conference on...· 0 citations
Cloud Computing has completely transformed the way businesses operate today with its scalability, flexibility, and cost efficiency. Cloud platforms have become a key component for organizations in various sectors to store data, deploy software, manage infrastructure, and implement digital transformation efforts. But the adoption of cloud computing has made it extremely challenging to deal with several security concerns like data breach, cyberattacks, unauthorized access, insider threats, and compliance concerns. The research paper employs secondary data collection and thematic analysis to critically discuss challenges of cloud security and risk management approaches in contemporary cloud computing environment. A thorough literature review of the scholarly papers from 2015 to 2023 is conducted to assess cybersecurity threats, cloud vulnerabilities, identity management systems, encryption technologies, compliance frameworks, and artificial intelligence-based threat detection systems.Peer reviewed journal articles, conference papers and industry reports were analysed using the method of themed analysis, which identified themes that appeared repeatedly throughout. The results show that cloud environments are still very susceptible to advanced cyberattacks, ranging from weak authentication and insecure APIs to misconfigured cloud services and inadequate governance. The study also points out the effectiveness of modern technologies like multi-factor authentication, zero-trust security models, artificial intelligence, and encryption enhance cloud security performance. But there are still issues in the way of the organizations' operations regarding regulatory compliance, data governance and shared security responsibilities.The study demonstrates that the key factors to achieving effective cloud security are continuous monitoring, robust governance policies, employee awareness training, and high-level cybersecurity frameworks. The study adds to the body of knowledge about the security of cloud computing, and offers practical suggestions for any organization working in the cloud.
Veeramani Sampathkumar, Dinesh Kumar Ramaraj, Rajesh Kotha et al.· International journal of com...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
