Desain dan Prototipe Simulasi Sistem Active Response Berbasis Wazuh Untuk Deteksi dan Mitigasi Serangan Malware Terintegrasi Threat Intelligence
DOI:
https://doi.org/10.61231/tccr6w18Keywords:
Active response, Malware, Threat Intelligence, VirusTotal, WazuhAbstract
Malware is a growing cyber threat designed to operate covertly to steal data and even take control of a system without the owner's knowledge. This research aims to design and implement a Wazuh-based Active Response system integrated with Threat Intelligence to automatically detect and mitigate malware attacks, using the Network Development Life Cycle (NDLC) method with the stages of Analysis, Design, and Prototyping Simulation, utilizing Ubuntu Server as the Wazuh Server, Windows Server 2019 as the Wazuh Agent, File Integrity Monitoring (FIM), and the VirusTotal API. The test results show that the Detection Rate and Mitigation Success Rate reach 100% on .exe files and compressed files that have been extracted, with a Response Time of seconds and a False Positive Rate of 0%. However, the system has not been able to detect malware in compressed files before they are extracted due to hash scanning limitations. The system has proven effective in accelerating mitigation and increasing the success of handling malware threats. Further research is recommended to add other Threat Intelligence sources, variations of Wazuh Agent, and testing in production environments.
References
Chamkar, S. A., Zaydi, M., Maleh, Y., & Gherabi, N. (2025). Improving Threat Detection in Wazuh Using Machine Learning Techniques. In Journal of Cybersecurity and Privacy (Vol. 5, Nomor 2, hal. 34). https://doi.org/10.3390/jcp5020034
Damanik, A. R., Seta, H. B., Universitas, D., Nasional, P., & Jakarta, V. (2023). Analisis Trojan Dan Spyware Menggunakan Metode Hybrid Analysis. Jurnal Ilmiah MATRIK, 25(1), 89–97. https://doi.org/10.33557/jurnalmatrik.v25i1.2327
Djamalyanto, M., Widyawati, L., Husain, H., & Hariyadi, I. P. (2025). Implementasi Security Information and Event Management Untuk Mencegah Serangan Deface Pada Server Terintegrasi Telegram. Melek IT : Information Technology Journal, 11(1), 31–42. https://doi.org/10.30742/melekitjournal.v11i1.398
Fahmi, R. N., Hartono, R., & Anwar, D. S. (2025). Integrasi Wazuh Siem Dengan Modsecurity Dan Virus Total Menggunakan Nist Framework Untuk Mendeteksi Serangan Website. JATI (Jurnal Mahasiswa Teknik Informatika), 9(4), 6578–6586. https://doi.org/10.36040/jati.v9i4.13804
Haryanto, B., & Chandra, D. W. (2024). Implementasi Wazuh Integritas File untuk Perlindungan Keamanan Berdasarkan Aktivitas Log di BTSI UKSW. Jurnal Indonesia : Manajemen Informatika dan Komunikasi, 5(1), 183–192. https://doi.org/10.35870/jimik.v5i1.447
Hidayat, M. R. T., Widiyasono, N., & Gunawan, R. (2025). Optimasi Deteksi Malware Pada Siem Wazuh Melalui Integrasi Cyber Threat Intelligence Dengan Misp Dan Dfir-Iris. Jurnal Informatika dan Teknik Elektro Terapan, 13(1), 588–601. https://doi.org/10.23960/jitet.v13i1.5686
Ilca, L. F., Lucian, P., & Balan, T. C. (2023). Enhancing Cyber-Resilience for Small and Medium-Sized Organizations with Prescriptive Malware Analysis, Detection and Response. Sensors, 23(15). https://doi.org/10.3390/s23156757
Kamil, A., Rizaludin, D., & Tsalitsatun, A. (2024). Implementasi Wazuh FIM ( File Integrity Monitoring ) untuk Perlindungan Keamanan Sistem Informasi pada Unit Kegiatan Mahasiswa di Universitas Trunojoyo Madura. Sains Data Jurnal Studi Matematika dan Teknologi, 2(2), 80–92. https://doi.org/10.52620/sainsdata.v2i2.127
Kristiyanto, Y., Sugiyono, Perdana, C. A., & Sarah, S. (2024). Pengembangan Keamanan Komputer Dengan Teknologi Thin Client Dan Domain Controller Dengan Metode Network Development Life Cycle ( NDLC ). Jurnal Manajemen Informatika Jayakarta, 4(3), 258–265. https://doi.org/10.52362/jmijayakarta.v4i3.1531
Kurniawan, C., Triayudi, A., Technology, I., & Nasional, U. (2024). File Integrity Monitoring as a Method for Detecting and Preventing Web Defacement Attacks. JOIN (Jurnal Online Informatika), 9(2), 276–285. https://doi.org/10.15575/join.v9i2.1326
Manzoor, J., Waleed, A., Jamali, A. F., & Masood, A. (2024). Cybersecurity on a budget: Evaluating security and performance of open-source SIEM solutions for SMEs. PLOS ONE, 19(3), 1–24. https://doi.org/10.1371/journal.pone.0301183
Na’im, M. R., & Kurniawan, Y. (2026). Otomatisasi Respons pada Sistem Keamanan Siber Terintegrasi Threat Intelligence pada Pusat Data Pemerintah Kota Tangerang dengan Metode PPDIOO. SUDO JURNAL TEKNIK INFORMATIKA, 5(2), 188–201. https://doi.org/10.56211/sudo.v5i2.1742
Prayitno, M. H., & Yasir, M. (2025). Peran Metode Network Development Life Cycle (NDLC) pada Implementasi Failover Base Transceiver Station. Innovative: Journal Of Social Science Research, 5(2), 2146–2158. https://doi.org/10.31004/innovative.v5i2.18512
Putra, M. A. E., Hariyadi, I. P., & Marzuki, K. (2025). Otomatisasi Konfigurasi Wazuh Terintegrasi Virustotal Menggunakan Ansible Untuk Mendeteksi Dan Memproteksi Serangan Malware. MELEK IT :iINFORMATION TECHNOLOGY JOURNAL, 11(1), 55–66. https://doi.org/10.30742/melekitjournal.v11i1.403
Shafiyyah, A., Nama, G. F., & Pradipta, R. A. (2024). Implementasi Wazuh Menggunakan Metode PPDIOO di Sistem Keamanan Jaringan PSDKU Universitas Lampung Waykanan Sebagai Deteksi Dan Respon Serangan Siber. Jurnal Informatika dan Teknik Elektro Terapan (JITET), 12(2), 970–982. https://doi.org/10.23960/jitet.v12i2.4074
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Mulyana Mulyana, I Putu Hariyadi , Ondi Asroni
This work is licensed under a Creative Commons Attribution 4.0 International License.
You are free to:
- Share — copy and redistribute the material in any medium or format for any purpose, even commercially.
- Adapt — remix, transform, and build upon the material for any purpose, even commercially.
- The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution — You must give appropriate credit , provide a link to the license, and indicate if changes were made . You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
Notices:
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation .
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
