Simulation and Performance Testing of the Ganesha Honeypot System (GHOST) for SSH Security

One of the problems with information and communications technology is the occurrence of a brute force Secure Shell (SSH) attack. One solution used for the security problem of the network is Honeypot. Honeypots that can be used on SSH are Honeypot Kippo and Cowrie. Kippo and Cowrie Honeypot are included in the Medium Interaction Honeypot. The aim of this study is to improve the performance of Honeypot Cowrie by adding web-based monitoring with Kippo-Graph and also to provide notifications using the Telegram API when there is a SSH brute force attack that succeeds in entering and running the command line, the Honeypot Server is known as the Ganesha Honeypot System (GHOST). Based on the results of testing with the Zero Entity Hacking (ZEH) Method consisting of 4 stages, the first stage performing port scanning was obtained that there is an open port, port 22 which is the port for SSH. At the second stage obtains Vulnerable on the SSH port, then the third stage performs Exploitation by performing an attack brute force login SSH with the help of tools Hydra with three tests namely Level 1, Level 2 and Level 3 with the wordlist specified. In the third phase, of the 3 tests there were a total of 1739 attempts to enter through SSH, of these 1739 899 brute force attacks succeeded and 840 attacks failed, and of the 899 Brute force attacks, the successful notification received by the admin via telegram is 97%. In the monitoring resource, each level of attack brute force resource used by GHOST is increasing. Results from the Visual Honeypot Log obtained information about the number of attacks, up to any input that was run on the honeypot in a web form with the help of Kippo-Graph.