Analisis dan Penanganan Insiden Siber SQL Injection Menggunakan Kerangka NIST SP 800-61R2 dan Algoritma Klusterisasi K-Means

Abstract

Based on the OWASP Top Ten document in 2021, attacks or vulnerabilities in an application in the form of injection still rank in the top 3. SQL Injection attacks are still classified as injection vulnerabilities so they need special attention from Information & Communication Technology Managers. Badan Siber dan Sandi Negara (BSSN) has published a document related to preventing SQL Injection attacks. However, the document has not included a cyber attack analysis process that uses the K-Means clustering approach. So in this research, a collaborative method of handling cyber attacks in the form of SQL Injection is proposed using the NIST SP 800-61R2 framework as a fundamental for handling cyber attacks and K-Means clustering. Before analyzing cyber attacks, it is better to use a framework or standardization that applies globally. Based on the research conducted, the K-Means clustering algorithm can help cybersecurity analysts in the process of analyzing cyber attacks that occur. The result of this research is that the optimal value is obtained that cyber attacks in the form of SQL Injection, namely 3 clusters. The hope of the research can facilitate cybersecurity analysts in analyzing cyber attacks that are poured into reports to parties in need