Implementation of Suricata and Cyber Attack Analysis with SIEM for Attack Verification and Mitigation

Abstract

The escalating complexity of cyber threats, encompassing web application exploitations, Denial-of-Service (DoS), and brute-force attacks, necessitates cloud infrastructures to deploy adaptive and automated defense mechanisms. Standalone conventional detection systems frequently fall short in delivering immediate responses to multi-vector attacks. This research aims to design and implement a robust Defense in Depth (DiD) security architecture that synergizes network visibility, application-level security, and automated incident response powered by Security Information and Event Management (SIEM). The experimental environment was constructed on a cloud server, utilizing the Damn Vulnerable Web Application (DVWA) as the evaluation target. The defensive framework integrates ModSecurity as a Web Application Firewall (WAF) at the application layer, Suricata as a Network Intrusion Detection System (NIDS) at the network layer, and Wazuh as the centralized SIEM orchestrator. Penetration testing was executed via Kali Linux, simulating critical attack vectors including DoS, authentication brute-force, and web-based injections (SQLi, XSS, and File Upload). The empirical results demonstrate the architecture's high efficacy in real-time threat detection and mitigation. ModSecurity instantaneously intercepted malicious applicationlayer payloads, while Wazuh successfully correlated logs from Suricata and ModSecurity to trigger its Active Response module. This automation seamlessly executed a full IP block via iptables upon reaching predefined threat thresholds. Ultimately, the integration of Wazuh, Suricata, and ModSecurity establishes a resilient Defense in Depth ecosystem, significantly minimizing incident response times and fortifying cloud server defenses without requiring manual administrative intervention.