Pengembangan Sistem Pendukung Investigasi Serangan Siber Berdasarkan Log Server Web Menggunakan Algoritma HDBSCAN

Abstract

The increasing frequency of cyberattacks on web applications demands a more systematic mechanism for analyzing and investigating server log data. This research aims to design a cyberattack investigation support system based on web server log analysis, evaluate the impact of parameter selection in the HDBSCAN algorithm, and assess its performance in clustering access patterns that may indicate anomalous activities. The proposed system implements a series of stages, including log preprocessing, URL pattern masking, pattern extraction and normalization, chunking, URL embedding into numerical representations, and clustering using the HDBSCAN algorithm. The system is also equipped with visualization components and automatic report generation in .txt, .csv, .json, and .html formats to support the analysis and interpretation process. Clustering quality evaluation is conducted using three metrics: Silhouette Score, Davies-Bouldin Index, and Calinski-Harabasz Score. The results show that the system is capable of processing log data comprehensively and generating meaningful mappings of access patterns relevant to security investigation workflows. Using the optimal parameters min_cluster_size = 20 and min_samples = 10, HDBSCAN produces 802 clusters and 325 noise points, achieving a clustering success rate of 99.6%. Noise analysis reveals the presence of various attack patterns, including SQL Injection, Cross-Site Scripting (XSS), path traversal, and Remote Code Execution (RCE) attempts. Quantitative evaluation yields a Silhouette Score of 0.0736, a Davies-Bouldin Index of 2.4756, and Calinski-Harabasz Score of 3473.67, indicating a reasonably stable cluster structure suitable for anomaly detection in web application logs. Overall, this research demonstrates that HDBSCAN is an effective approach for URL pattern clustering and has strong potential as an analytical component in cyberattack investigation support systems.