Deteksi Serangan Brute Force SSH Menggunakan Klasifikasi Naïve Bayes pada Log Cowrie Honeypot di Lingkungan Virtual

Prasetyo, Arya Adhari
Herianto
Yahya
Syamsiyah, Nur

TIFDA : Journal Technology Information and Data Analytic
Vol 2 No 1 (2025): Journal Technology Information and Data Analytic (TIFDA)

The increasing number of brute force cyberattacks targeting SSH services highlights the urgent need for effective early detection and mitigation systems. This study aims to analyze brute force attack patterns using the Naïve Bayes classification algorithm based on log data generated by the Cowrie Honeypot. A simulated virtual environment was developed to emulate attack scenarios and generate authentic SSH log data while preserving real server confidentiality. The system architecture follows the CRISP-DM framework, including data preprocessing, model development, evaluation, and deployment. Evaluation using confusion matrix metrics showed that the Naïve Bayes algorithm successfully distinguished brute force attempts from normal traffic with high accuracy, precision, recall, and F1-score. The findings confirm the potential of combining Cowrie honeypot data with machine learning classifiers as an early warning tool for intrusion detection in enterprise network infrastructures.