Electronic Theses and Dissertation

Serangan siber yang terus berkembang menuntut mekanisme deteksi yang adaptif melampaui deteksi berbasis signature. penelitian ini mengembangkan prototipe deteksi anomali jaringan dengan mengintegrasikan suricata sebagai sensor dan pencatat log (eve.json), deep reinforcement learning (drl) dengan algoritma proximal policy optimization (ppo) sebagai pengambil keputusan adaptif, serta bot telegram sebagai antarmuka notifikasi dan umpan balik waktu-nyata. pipeline mengekstraksi vektor fitur flow dan temporal yang konsisten (17 dimensi) dari eve.json, menormalkan, lalu memberi masukan ke agen drl untuk memutuskan aksi monitor atau block. implementasi dievaluasi pada lingkungan vmware (nat/vmnet8) dengan skenario lalu lintas benign dan tiga serangan terkontrol yaitu port scanning, brute-force ssh, dan dos (syn flood). hasil menunjukkan akurasi 99,13%, macro-f1 0,9912, presisi kelas serangan 0,9999, recall kelas serangan 0,9842, dan false positive rate ≈0,016% (11 fp dari 69.672 benign). notifikasi telegram tercatat

The ever-evolving nature of cyberattacks demands adaptive detection mechanisms beyond signature-based detection. This research develops a network anomaly detection prototype by integrating Suricata as a sensor and log logger (eve.json), Deep Reinforcement Learning (DRL) with a Proximal Policy Optimization (PPO) algorithm as an adaptive decision maker, and a Telegram Bot as a Real-Time notification and feedback interface. The pipeline extracts consistent flow and temporal feature vectors (17 dimensions) from eve.json, normalizes them, and then feeds them to the DRL agent to decide whether to monitor or block. The implementation is evaluated on a VMware environment (NAT/VMnet8) with benign traffic scenarios and three controlled attacks wich is port scanning, SSH brute-force, and DoS (SYN flood). The results show an Accuracy of 99.13%, a macro-F1 of 0.9912, an attack class Precision of 0.9999, an attack class Recall of 0.9842, and a False Positive rate of ≈0.016% (11 FPs out of 69,672 benign). Telegram notifications recorded