<![CDATA[GoldenEye Distributed Denial-of-Service (DDoS) attacks on OwnCloud services can cause increased network traffic, unstable server responses, and disruptions to the availability of private cloud services. This research aims to implement the Knowledge Understanding Assessment Defense (KUAD) method as a restorative network forensics approach to detect, validate, analyze, and mitigate GoldenEye DDoS attacks against OwnCloud services. The research object was an OwnCloud service running on Ubuntu Server 22.04, with Apache2 serving as the web server. The equipment used included a MikroTik CCR1016-12G router, a monitoring computer running Kali Linux 2025.1, and several tools, including Wireshark, Ettercap, Apache access logs, nload, and Iptables. The KUAD method was implemented through the stages of attack detection, evidence acquisition, cross-source data validation, attack-impact analysis, mitigation, and documentation of the incident-handling results. Validation was performed by correlating Wireshark data with access.log records based on IP addresses and timestamps. The results showed that the attacks originated from three IP addresses: 140.213.174.152, 140.213.172.203, and 36.72.217.84. All three addresses sent HTTP GET requests to the /OwnCloud/index.php endpoint, resulting in the HTTP 400 Bad Request status code. All 10 attack records were successfully validated, resulting in a digital evidence validation rate of 100%. The IP address 140.213.172.203 accounted for the largest share of attack activity at 40%, while 140.213.174.152 and 36.72.217.84 each accounted for 30%. The average timestamp difference was 0 seconds, the attack rate reached 0.4 requests per second, and the HTTP 400 status code accounted for 100% of the recorded responses. Following mitigation with iptables, attack activity was reduced by 100%. Overall, the KUAD method effectively supported a network forensics process that was not only investigative but also restorative and quantitatively measurable.]]>
