Article Per Year (5 Year)
p-Index From 2021 - 2026
0.23
P-Index
This Author published in this journals
All Journal RABIT: Jurnal Teknologi dan Sistem Informasi Univrab
Julang Tahta Pratangga
Universitas Dian Nuswantoro
Computer Science & IT Engineering

Published : 1 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 1 Documents
Search

 1 
DETEKSI DAN MITIGASI SERANGAN POST-EXPLOITATION PADA LINGKUNGAN CONTAINER LINUX MENGGUNAKAN CROWDSEC DAN AUDITD Julang Tahta Pratangga; Chaerul Umam; L. Budi Handoko; Wildanil Ghozi
Rabit : Jurnal Teknologi dan Sistem Informasi Univrab Vol 11 No 2 (2026): Juli
Publisher : LPPM Universitas Abdurrab

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.36341/rabit.v11i2.8461

Abstract

Containerized environments present significant security challenges due to their shared kernel architecture, which may be exploited as an entry point for infiltration attacks. One common vulnerability is Command Injection, enabling post-exploitation activities that are difficult to detect using conventional signature-based mechanisms. This study aims to implement and evaluate an active mitigation mechanism based on behavioral analysis by integrating the Linux Audit Daemon (Auditd) and CrowdSec within a Podman container environment. The research adopts an Experimental Security Testing approach by developing a Custom Process Bouncer that specifically monitors the execve system call to identify process relationships and automatically terminate malicious processes. Test results against four detection scenarios demonstrate that the proposed mechanism successfully reconstructed the attack process chain through PID cascade analysis and detected six malicious processes generated during the Command Injection scenario. All identified processes were automatically terminated with precision, causing the reverse shell session to be interrupted. These findings conclude that the integration of Auditd, CrowdSec, and the Custom Process Bouncer effectively neutralizes post-exploitation activities reliant on binary file execution, though further development is required to address fileless execution tactics.
Co-Authors Chaerul Umam L. Budi Handoko Wildanil Ghozi