Design of Security Information and Event Management (SIEM) to Detect Incidents on Websites

Abstract

In an increasingly complex digital era, websites are the main target for attacks by irresponsible parties. Therefore, a system is needed that can monitor, analyze, and provide early warning against suspicious activity or attacks that occur on websites. For this reason, this research analyzes and designs a Security Information and Event Management (SIEM) system that can be used to detect incidents of attacks on websites. The SIEM built in this study uses an Elastic Stack which will be used to analyze, monitor, detect, and store event information or security logs for each connected agent. To simulate testing types of attacks on websites such as the OWASP TOP 10 2017, several vulnerable web applications are used, namely DVWA, XVWA, and MUTILLIDAE. Tests on the SIEM system that was created showed that the system was able to detect the types of attacks on websites as mentioned in the OWASP TOP 10 2017.