Penerapan DFA untuk Deteksi Serangan TCP SYN dan Ping Flood dengan Visualisasi pada Lingkungan GNS3

Abstract

The rapid development of computer network technology has increased communication efficiency but also raised the risk of cyberattacks, particularly Denial of Service (DoS) attacks such as TCP SYN Flood and ICMP Flood. Conventional Intrusion Detection Systems (IDS) generally rely on static log analysis and lack responsive real-time monitoring visualization. This research aims to design and implement an Intrusion Detection System based on Deterministic Finite Automaton (DFA) for detecting TCP SYN Flood and ICMP Flood attacks in a virtualized network environment. The research method used is an experimental approach through network simulation using Graphical Network Simulator 3 (GNS3). The system utilizes MikroTik Router with TaZmen Sniffer Protocol (TZSP) for packet mirroring, Python with Scapy library for packet analysis and DFA state transition processing, Supabase as a real-time cloud database, and ReactJS as a monitoring dashboard interface. The DFA model classifies network conditions into three states, namely normal, alert, and intrusion, based on the number of packets received per second. The experimental results show that the proposed IDS successfully detects abnormal traffic generated by TCP SYN Flood and ICMP Flood attacks and performs state transitions accurately in real-time. In addition, the integration of Supabase and ReactJS enables the monitoring dashboard to display network security status dynamically without requiring manual page refresh. The implementation of a decoupled architecture also improves system flexibility, responsiveness, and scalability. The findings indicate that the proposed system can provide a lightweight and interactive real-time intrusion monitoring solution for computer network security environments.