Implementation of Intrusion Detection System Using Snort and Log Visualization Using ELK Stack

Fatih Dien Robbani, Emy Haryatmi, Tri Agus Riyadi, Riza Adrianti Supono, Ary Bima Kurniawan, Rosdiana Rosdiana

Abstract


Cyber threats like malware, ransomware, and DDoS attacks demand fast and integrated detection systems. Traditional network monitoring tools often struggle to identify complex real-time attack patterns. This study evaluates the integration of Snort, an Intrusion Detection System (IDS), with the ELK Stack (Elasticsearch, Logstash, Kibana) to detect and visualize cyberattacks effectively. The system was tested against three attack scenarios: a Windows ping flood, port scanning using Zenmap, and SSH brute force attacks via Nmap Scripting Engine (NSE). Wireshark was employed as a supporting tool to monitor raw network traffic. The results indicate that Snort detected all simulated attacks in real time, and the ELK Stack efficiently processed and visualized the alert data. However, limitations in Kibana's dashboard refresh rate slightly hindered real-time monitoring capabilities. Overall, the integration of Snort and the ELK Stack proves effective for network threat detection and analysis, with room for future improvements in visualization performance and automated response mechanisms.


Keywords


Snort, ELK Stack, Nmap, NSE, Ping Flood

Full Text:

PDF

References


Suroso and Sriyanto, “Evaluasi Keamanan Wireless Local Area Network Menggunakan Metode Penetration Testing pada RSUD Alimuddin Umar Di Lampung Barat,” J. IndraTech, vol. 5, no. 1, pp. 32–46, 2024, doi: 10.56005/jit.v5i1.138.

H. Suhendi and W. D. Cahyo, “Perancangan Dan Implementasi Keamanan Jaringan Menggunakan Snort Sebagai Intrusion Prevention System (IPS) Pada Jaringan Internet STEI ITB,” NARATIF(Jurnal Ilm. Nas. Ris. Apl. dan Tek. Inform., vol. 03, no. 2, pp. 60–68, 2021, doi: 10.53580/naratif.v3i02.137.

G. Pradita and A. Pramono, “Implementasi Monitoring Keamanan Jaringan Pada Server Ubuntu Menggunakan Snort Intrusion Detection Prevention System (IDPS) Dan Telegram Bot Sebagai Media Notifikasi Di PT SS UTAMA,” J. Mhs. Tek. Inform., vol. 8, no. 4, pp. 5827–5834, 2024, doi: 10.36040/jati.v8i4.10069.

Maulidar, E. Wanda, and M. Hijriatin, “Cybersecurity Awareness In HR: Protecting Employee Data in the Digital Era,” Int. J. Eng. Sci. Inf. Technol., vol. 5, no. 2, pp. 237–242, 2025, doi: https://doi.org/10.52088/ijesty.v5i2.819.

S. Akter, M. A. Hossain, and M. M. Rahman Redoy Akanda, “A Noble Security Analysis of Various Distributed Systems,” Int. J. Eng. Sci. Inf. Technol., vol. 1, no. 2, 2021, doi: 10.52088/ijesty.v1i2.101.

V. Gustina and A. Ananda, “Kecerdasan Buatan untuk Security Orchestration, Automation and Response: Tinjauan Cakupan,” J. Komput. Terap., vol. 10, no. 1, pp. 36–47, 2024, doi: 10.35143/jkt.v10i1.6247.

A. Gupta and L. Sen Sharma, “A categorical survey of state-of-the-art intrusion detection system-Snort,” Int. J. Inf. Comput. Secur., vol. 13, no. 3–4, pp. 337–356, 2020, doi: 10.1504/IJICS.2020.109481.

F. S. Mukti and R. M. Sukmawan, “Integration of Low Interaction Honeypot and ELK Stack as Attack Detection Systems on Servers,” J. Penelit. Pos dan Inform., vol. 11, no. 1, pp. 19–29, 2021, doi: 10.17933/jppi.v11i1.336.

A. Erlansari, F. F. Coastera, and A. Husamudin, “Early Intrusion Detection System (IDS) using Snort and Telegram approach,” SISFORMA - J. Inf. Syst., vol. 7, no. 1, pp. 21–27, 2020.

D. Satin S, Wahyuddin, A. Kautsar, and A. Setyawan, “Intrusion Detection System Menggunakan Snort dan Telegram Sebagai Media Notifikasi,” SisInfo J. Sist. Inf. dan Inform., vol. 7, no. 1, pp. 40–49, 2025.

S. S. Sari and A. Tedyyana, “Analisis Efektivitas Rule Snort dalam Mendeteksi Serangan Jaringan,” Repeater Publ. Tek. Inform. dan Jar., vol. 2, no. 4, pp. 1–15, 2024, doi: https://doi.org/10.62951/repeater.v2i4.194.

P. P. Insani, I. Kanedi, and A. Al Akbar, “Implementasi Snort Sebagai Alat Pendeteksi Keamanan Jaringan Wireless Menggunakan Linux Ubuntu,” J. Komputer, Inf. dan Teknol., vol. 3, no. 2, pp. 443–458, 2023, doi: 10.53697/jkomitek.v3.2.

W. Haniyah, M. C. Hidayat, Z. F. I. Putra, V. A. Pertama, and A. Setiawan, “Simulasi Serangan Denial of Service (DoS) menggunakan Hping3 melalui Kali Linux,” J. Internet Softw. Eng., vol. 1, no. 2, pp. 1–8, 2024, doi: 10.47134/pjise.v1i2.2654.

F. A. Saputra, M. Salman, J. A. N. Hasim, I. U. Nadhori, and K. Ramli, “The Next?Generation NIDS Platform: Cloud?Based Snort NIDS Using Containers and Big Data,” Big Data Cogn. Comput., vol. 6, no. 1, p. 19, 2022, doi: 10.3390/bdcc6010019.

V. Wineka Nirmala, D. Harjadi, and R. Awaluddin, “Sales Forecasting by Using Exponential Smoothing Method and Trend Method to Optimize Product Sales in PT. Zamrud Bumi Indonesia During the Covid-19 Pandemic,” Int. J. Eng. Sci. Inf. Technol., vol. 1, no. 4, 2021, doi: 10.52088/ijesty.v1i4.169.

S. Oktarian, S. Defit, and Sumijan, “Clustering Students’ Interest Determination in School Selection Using the K-Means Clustering Algorithm Method,” J. Inf. dan Teknol., vol. 2, pp. 68–75, 2020, doi: 10.37034/jidt.v2i3.65.

H. Awal and A. P. Gusman, “Implementasi Intrusion Detection Prevention System Sebagai Sistem Keamanan Jaringan Komputer Kejaksaan Negeri Pariaman Menggunakan Snort dan IPtables Berbasis Linux,” J. Sains Inform. Terap. E-ISSN, vol. 2, no. 2, pp. 74–80, 2023, doi: 10.62357/jsit.v2i1.184.

C. D. Alviani, A. S. Padi, and N. Puspitasari, “Keamanan Siber di Masa Depan : Tantangan dan Teknologi yang Dibutuhkan,” Semin. Nas. AMIKOM SURAKARTA 2024, vol. 2, pp. 1247–1254, 2024.

W. Sholihah, S. Pripambudi, and A. Mardiyono, “Log Event Management Server Menggunakan Elastic Search Logstash Kibana (ELK Stack),” JTIM J. Teknol. Inf. dan Multimed., vol. 2, no. 1, pp. 12–20, 2020, doi: 10.35746/jtim.v2i1.79.

S. Sapriadi, Y. Yunus, and R. W. Dari, “Prediction of the Number of Arrivals of Training Students with the Monte Carlo Method,” J. Inf. dan Teknol., vol. 4, pp. 1–6, 2022, doi: 10.37034/jidt.v4i1.168.

A. Setiyawan, A. Pinandito, and W. Purnomo, “Pengembangan Sistem Informasi Log Management Server Monitoring Menggunakan ELK (Elastic Search, Logstash dan Kibana) Stack pada Aplikasi Padichain di PT. Bank Rakyat Indonesia,” J. Pengemb. Teknol. Inf. dan Ilmu Komput., vol. 7, no. 5, pp. 2142–2151, 2023.

S. B. Dahal and M. Aoun, “Architecting Microservice Frameworks for High Scalability: Designing Resilient, Performance-Driven, and Fault-Tolerant Systems for Modern Enterprise Applications,” J. Intell. Connect. Emerg. Technol., vol. 8, no. 4, pp. 58–70, 2023.

A. Oussous and F. Z. Benjelloun, “A Comparative Study of Different Search And Indexing Tools For Big Data,” Jordanian J. Comput. Inf. Technol., vol. 8, no. 1, pp. 72–86, 2022, doi: 10.5455/jjcit.71-1637097759.




DOI: https://doi.org/10.52088/ijesty.v5i3.901

Article Metrics

Abstract view : 0 times
PDF - 0 times

Refbacks

  • There are currently no refbacks.


Copyright (c) 2025 Fatih Dien Robbani, Emy Haryatmi, Tri Agus Riyadi, Riza Adrianti Supono, Ary Bima Kurniawan, Rosdiana

International Journal of Engineering, Science, and Information Technology (IJESTY) eISSN 2775-2674