Investigation of Cyber Malware Attacks On Server Networks Using SIEM Method Based On NIST 800-61 Rev 2

Abstract

The growth of cyber threats, especially malware attacks on servers, has increased significantly and is increasingly complex. These attacks can cause huge losses, both in terms of data confidentiality, system integrity, and service availability. Slow and unstructured handling of security incidents can worsen the impact. This research aims to develop an efficient detection and response system to malware attacks, especially on servers that are the main targets of cyberattacks. This research uses a systematic and responsive approach using the NIST 800-61 Rev 2-based SIEM (Security Information and Event Management) framework in handling cyber incidents. The SIEM framework enables an investigation or digital forensics process that includes monitoring, correlating, and analyzing incidents to take place. Meanwhile, NIST 800-61 Rev 2 aims to analyze the investigation process or digital forensics of cybercrime cases and generate digital evidence. The results of this study show that malware cyberattacks tend to be silent and do not show any anomalies on the server. Digital forensic evidence is presented to detect the veracity of a malware attack.