Pengembangan Sistem Analisis Serangan Siber Pada Log Server Dengan Algoritma Bert Dan Deep Embedded Clustering

Abstract

The increasing reliance on digital infrastructure creates wider gaps for cyber threats, where server logs serve as the primary evidence in attack investigations. However, the massive volume of log data and its unstructured format pose a significant challenge for investigators performing manual analysis. This research aims to develop an automated cyber-attack analysis system using an unsupervised learning approach to identify suspicious activity patterns without relying on labeled data. The proposed methodology combines the Bidirectional Encoder Representations from Transformers (BERT) model for semantic log feature extraction and the Deep Embedded Clustering (DEC) algorithm for data grouping. This study utilizes one million rows of web server log data from a public dataset, processed through preprocessing stages including deduplication, normalization, and suspicious score calculation. Optimization was conducted through hyperparameter tuning using the random search method to identify the best model configuration. Experimental results demonstrate that the all-MiniLM-L6-v2 Sentence Transformer model provides the best embedding representation with a Silhouette Score of 0.7866 and a Davies-Bouldin Index (DBI) of 0.5527. The integration of BERT and DEC models proved highly effective, achieving a Silhouette Score of 0.7921, significantly outperforming the conventional K-Means method which only reached 0.5301. Furthermore, the deduplication technique successfully increased system efficiency with a data compression ratio of 20.10x. The developed system prototype proved responsive in interactively exploring large-scale log data.