Detection of Online Gambling Web Defacement in University Domains Using Attack Signatures

Various instances of web defacement in the form of online gambling sites have been identified within the domains of higher educational institutions (ac.id). These incidents present significant threats to the integrity and reputation of these institutions, necessitating the development of a detection mechanism. An Intrusion Detection System (IDS) is a network software solution designed to monitor traffic and identify potentially harmful activities. Suricata, a widely utilized IDS, plays a crucial role in this process. Specific rules are essential for identifying online gambling web defacement using Suricata. The identification of online gambling web defacement using Suricata relies on meticulously crafted rules based on attack signatures. These signatures are derived from a set of 30 keywords commonly associated with web defacement within university domains. The keywords are initially extracted using the bigram TF-IDF (Term Frequency-Inverse Document Frequency) method. To further enhance the precision of this keyword set, a Chi-square test is applied to assess the statistical significance of each keyword's association with defaced web pages. The refined rules have proven to be highly effective, achieving a True Positive Rate (TPR) of 0.95, a True Negative Rate (TNR) of 0.99, a Positive Predictive Value (PPV) of 0.99, a Negative Predictive Value (NPV) of 0.96, an overall accuracy of 0.97, and an F1-Score of 0.97.