Desain dan Prototipe Simulasi Sistem Active Response Berbasis Wazuh Untuk Deteksi dan Mitigasi Serangan Malware Terintegrasi Threat Intelligence

Mulyana Mulyana (Universitas Bumigora)
I Putu Hariyadi (Universitas Bumigora)
Ondi Asroni (Universitas Bumigora)

Jurnal Penelitian dan Pengabdian Masyarakat
Vol. 4 No. 4 (2026): November 2026 In Press

Malware is a growing cyber threat designed to operate covertly to steal data and even take control of a system without the owner's knowledge. This research aims to design and implement a Wazuh-based Active Response system integrated with Threat Intelligence to automatically detect and mitigate malware attacks, using the Network Development Life Cycle (NDLC) method with the stages of Analysis, Design, and Prototyping Simulation, utilizing Ubuntu Server as the Wazuh Server, Windows Server 2019 as the Wazuh Agent, File Integrity Monitoring (FIM), and the VirusTotal API. The test results show that the Detection Rate and Mitigation Success Rate reach 100% on .exe files and compressed files that have been extracted, with a Response Time of seconds and a False Positive Rate of 0%. However, the system has not been able to detect malware in compressed files before they are extracted due to hash scanning limitations. The system has proven effective in accelerating mitigation and increasing the success of handling malware threats. Further research is recommended to add other Threat Intelligence sources, variations of Wazuh Agent, and testing in production environments.