Publication Search

Malware represents an evolving cybersecurity threat that demands more effective detection methods. Conventional signature-based detection systems have limitations in identifying new variants, driving the development of deep learning-based approaches. This research implements and evaluates four variants of the YOLOv11 algorithm (n, s, m, l) for malware classification based on visual image representation. The dataset consists of 22,056 malware and benign images, divided into 70% training, 15% validation, and 15% testing across 8 classes (adware, backdoor, benign, downloader, spyware, trojan, virus, worm). Each model was trained for 100 epochs with batch size 32 using Google Colab with GPU support. Results demonstrate that all variants achieve high accuracy (97.8%-98.1%) with YOLOv11m as the best performer (98.1%). YOLOv11n offers optimal balance between accuracy (97.9%) and efficiency (1.5M parameters, 0.3 ms/img inference) ideal for real-time applications. This research surpasses previous methods such as K-NN (97.18%) and hybrid CNN (96.55%) with superior inference speed (0.3-0.9 ms/img vs tens to hundreds of ms/img), proving the effectiveness of YOLOv11 for fast, accurate, and scalable malware detection.

The increasing sophistication of malware has rendered traditional signature-based detection methods insufficient, necessitating behavior-driven and adaptive analytical frameworks. This study presents a sequential deep learning framework that models system-level API call sequences as structured linguistic representations for behavioral malware detection. Unlike conventional comparative studies, this work systematically evaluates recurrent and attention-based architectures under controlled experimental conditions, with a particular focus on generalization performance and overfitting mitigation. Two neural architectures, a Long Short-Term Memory (LSTM) network and a Transformer-based attention model, are trained on publicly available API call sequence data for binary classification of malicious and benign executables. Beyond standard accuracy metrics, the study further examines model stability, convergence behavior, and the impact of long-range dependency modeling on detection robustness. Experimental results demonstrate that the Transformer architecture achieves superior performance, attaining 95.54% classification accuracy and consistent improvements in precision, recall, and F1-score, indicating a stronger ability to capture complex behavioral dependencies. These findings highlight the effectiveness of attention mechanisms in behavioral malware modeling and provide empirical evidence that NLP-inspired architectures offer a robust and scalable approach for real-world cybersecurity applications.

This study presents a comprehensive comparative analysis of four traditional machine learning algorithms Decision Tree, Random Forest, K-Nearest Neighbors, and Support Vector Machine for Android malware detection using the preprocessed TUANDROMD dataset comprising 4,465 instances and 241 features representing both static and dynamic application characteristics. Motivated by the limitations of conventional signature-based and hybrid detection methods, especially in managing imbalanced datasets and detecting emerging malware variants, the study employed SMOTE to ensure balanced training data and fair model evaluation. The dataset was divided into 80% training and 20% testing subsets, and models were assessed using key performance metrics including accuracy, precision, recall, F1-score, and ROC AUC. The findings revealed that the proposed Random Forest model outperformed the other classifiers, achieving an accuracy of 0.993, precision of 0.992, recall of 1.000, F1-score of 0.996, and a near-perfect ROC AUC of 0.9998 surpassing state-of-the-art approaches. These results affirm the superior predictive capability, consistency, and robustness of the Random Forest algorithm in Android malware detection. The study concludes that base models, when integrated with class-balancing techniques, provide reliable and efficient malware detection across imbalanced datasets. For future research, the study recommends exploring advanced hybrid or ensemble frameworks that integrate Random Forest with deep learning architectures or other meta-heuristic optimization techniques to further enhance detection accuracy, adaptability, and resilience against rapidly evolving Android malware threats.

This study presents a Graph-Augmented Isolation Forest (GAIF), an unsupervised anomaly-detection framework for analyzing mobile user behavior. The proposed framework represents users and behavioral attributes as a user–feature bipartite graph, enabling the capture of relational dependencies that are not explicitly modeled in conventional vector-based approaches. Low-dimensional user representations are learned through Node2Vec and Graph Sample and Aggregate (GraphSAGE), and the resulting embeddings are subsequently processed by an Isolation Forest to produce anomaly scores. Experiments are conducted on a Mobile Device Usage and User Behavior dataset comprising 700 user profiles derived from application-level behavioral indicators. The dataset is treated as a behavioral abstraction rather than as a malware classification benchmark. A consistent 80:20 stratified train–test split is employed, with all learning-capable operations restricted to the training data to mitigate information leakage. Detection performance is evaluated post hoc using precision, recall, F1-score, and area under the curve (AUC) metrics. Under the evaluated setting, GAIF achieves an F1-score of 0.94 and an AUC of 0.97, demonstrating improved anomaly detection effectiveness relative to representative unsupervised baseline methods. These results are obtained on a static, proxy dataset and should not be interpreted as evidence of real-time deployment capability. Model interpretability is supported through post-hoc Uniform Manifold Approximation and Projection (UMAP) visualizations of the learned embeddings, providing structural insights into anomalous user behavior. Overall, the findings indicate that integrating graph-based representation learning with isolation-based anomaly scoring constitutes a computationally efficient approach for unsupervised mobile user behavior anomaly detection within the scope of this study.

The increasing sophistication of cyber threats has rendered traditional cybersecurity models insufficient in safeguarding enterprise networks. This study introduces a risk aware cybersecurity governance model that integrates real time threat intelligence with predictive anomaly detection to proactively mitigate potential threats. By leveraging advanced machine learning and AI techniques, the model enhances the ability to identify and address cyber threats before they can escalate into significant incidents. The model’s ability to predict anomalies, analyze real time threat intelligence feeds, and provide early warnings allows for faster response times and reduced risk exposure compared to traditional reactive models. Through simulations and real-world use cases, the proposed model demonstrated a 30% reduction in response time and a 25% decrease in overall risk exposure, showing its potential to improve security decision-making and resilience in dynamic threat environments. Unlike traditional models that rely on static rules and periodic policies, the proposed model uses predictive analytics to stay ahead of evolving threats, ensuring continuous monitoring and rapid adaptation. This proactive approach enhances organizational resilience, particularly in handling sophisticated cyber threats such as ransomware, malware, and phishing attacks. Despite its effectiveness, challenges such as data overload, scalability, and the need for interpretability in AI models remain. Future research will focus on refining predictive models, improving scalability for larger networks, and enhancing the explainability of machine learning models to foster greater trust in automated cybersecurity systems. This study contributes to the ongoing evolution of cybersecurity governance by demonstrating the value of integrating predictive and real time monitoring technologies for enhanced threat detection and mitigation.

Tangerang City has the most applications in Indonesia, with 222 applications. All of these applications are supported by more than 100 servers located in the data center of the Tangerang City Communication and Information Agency. The large number of servers and applications that are managed brings up new problems in the midst of increasing complex cyber threats, especially in government data centers. One of them is how to monitor and respond quickly when there is an attack on the existing system. The implementation of a cyber security system based on Wazuh, Shuffle, and YARA is able to monitor threats in realtime and automate responses against attacks. Wazuh acts as a log-based monitoring and detection platform and behavior analysis, Shuffle is used to automate incident response through integrated workflow, and YARA is applied for signature-based malware identification. The PPDIOO (Prepare, Plan, Design, Implement, Operate, Optimize) method used in this research is used as a framework in designing and evaluating the system. From the research conducted, it is expected that Wazuh successfully monitors anomalies that occur on the server which will then be forwarded to Shuffle to automate the next steps to be taken. YARA integrated with Wazuh also successfully detects and quarantines malicious files that enter the server automatically based on the available signature list.

This study explores the development and application of a digital twin-driven cybersecurity risk assessment model for Industrial Internet of Things (IIoT) networks. The increasing complexity and interconnectivity of IIoT systems have expanded the attack surface, making them vulnerable to a wide range of cyber threats. The digital twin model addresses this challenge by creating real-time virtual replicas of physical systems, which can simulate and predict network vulnerabilities and attack vectors. The model uses machine learning algorithms and real-time data to simulate cyberattacks, including Distributed Denial of Service (DDoS), malware, and data breaches. By providing continuous monitoring and dynamic risk predictions, the digital twin model enhances the resilience of IIoT networks compared to traditional cybersecurity frameworks. The findings indicate that the model's ability to predict potential cyber threats and simulate various attack scenarios provides a more proactive and accurate approach to cybersecurity in IIoT environments. Additionally, the study highlights key mitigation strategies, including adaptive security mechanisms, real-time anomaly detection, and the use of lightweight encryption for resource-constrained devices. Despite its effectiveness, challenges such as computational requirements, integration with legacy systems, and scalability were identified. This research underscores the strategic importance of digital twin models in securing IIoT systems and advancing Manufacturing 4.0 ecosystems. Future research should focus on enhancing model accuracy, expanding its application to diverse industrial sectors, and improving interoperability with legacy systems to further strengthen the security posture of IIoT networks.

Relational databases, an essential component in modern information systems, are vulnerable to various security threats, both internal such as abuse of access rights, and external such as SQL injection, malware, and hacking. Given these conditions, how can relevant mitigation strategies be implemented to protect data security in relational databases? This article aims to identify the main threats to relational database security and map out relevant mitigation strategies. The method used is a literature review of various recent scientific journals that discuss aspects of data security in the context of relational databases. The results of the review indicate that threats such as SQL injection can be overcome by strict input validation, abuse of access rights can be prevented through role-based access control (RBAC), malware attacks can be detected using an intrusion detection system (IDS), and hacking actions can be minimized through the implementation of data encryption. This study is expected to be a reference in designing effective security strategies to protect data in relational databases.

Penelitian ini dimaksudkan untuk merancang sistem keamanan jaringan berbasis keamanan Siber yang efektif dalam mengurangi ancaman siber pada infrastruktur Teknologi Informasi (TI) di Indonesia. Seiring dengan meningkatnya serangan siber yang menyerang sektor-sektor beragam, termasuk pemerintahan, perbankan, dan kesehatan, negara ini menghadapi tantangan besar dalam menjaga integritas dan keamanan data. Berdasarkan data dari Badan Siber dan Sandi Negara (BSSN) dan laporan AwanPintar.id, ancaman siber seperti malware, ransomware, dan DDoS semakin meningkat, yang menyebabkan kerugian signifikan pada sektor TI. Oleh karena itu, perancangan sistem keamanan yang kuat dan sesuai dengan regulasi keamanan nasional sangat diperlukan. Penelitian ini menggunakan kombinasi pendekatan antara teknologi keamanan jaringan yang telah ada, seperti Intrusion Detection Systems (IDS) SNORT, Port Knocking, dan penerapan Artificial Intelligence (AI) dalam mendeteksi ancaman berbasis perilaku. Hasil penelitian menunjukkan bahwa pendekatan ini tidak hanya dapat meningkatkan deteksi dan respons terhadap ancaman siber, tetapi juga mematuhi regulasi yang ditetapkan oleh BSSN. Sistem yang diusulkan diharapkan dapat mengurangi kerugian yang ditimbulkan oleh serangan siber dan meningkatkan keamanan infrastruktur TI di Indonesia.

This study aims to explore the application of blockchain in enhancing server security to mitigate ransomware and malware attacks in critical infrastructures such as healthcare, finance, and government sectors. Using a systematic literature review (SLR) approach, the research collects articles from four major databases (IEEE Xplore, Scopus, ScienceDirect, and SpringerLink) published between 2020 and 2024. The search focuses on keywords related to blockchain, server security, ransomware, malware, and attack mitigation. The results indicate that blockchain enhances data integrity, transaction security, and strengthens access control to protect sensitive data. Moreover, integrating blockchain with intrusion detection systems (IDS) and using smart contracts accelerates threat detection and response, allowing for automatic blocking and data recovery from attacks. This technology reduces reliance on manual intervention and increases operational efficiency. However, the main challenges in its implementation include high implementation costs, scalability, and technical complexity. Nevertheless, blockchain offers significant solutions for mitigating ransomware and malware attacks while enhancing the reliability and efficiency of systems. In conclusion, blockchain provides an effective solution for server security and cyber threat mitigation, although challenges related to cost and scalability need to be addressed. Further research is required to develop more efficient blockchain protocols and integrate them with other technologies to enhance threat detection and response speed.

The Internet of Things (IoT) is an innovative technology that makes our environment smarter, with IoT devices as an integral part of home automation. Smart home systems are becoming increasingly popular as an IoT service in the home that connects via a network. Due to the security weakness of many devices, the malware is targeting IoT devices. After being infected with malicious attacks on smart devices, they act like bots that the intruders can control. Machine learning methods can assist in improving the attack detection process for these devices. However, the irrelevant features raise the computation time as well as affect the detection accuracy in the processing with many features. We proposed a machine learning-based IoT security framework using feature correlation. The feature extraction scheme, one-hot feature encoding, correlation feature selection, and attack detection implement an active detection mechanism. The results show that the implemented framework is not only for effective detection but also for lightweight performance. The proposed system outperforms the results with the selected features, which have almost 100% detection accuracy. It is also approved that the proposed system using CART is more suitable in terms of processing time and detection accuracy.

In the ever-growing digital era, banking services also continue to develop and become important for both individuals and businesses to carry out financial transactions quickly and easily. With these technological advances, serious concerns have arisen regarding the security of banking service data. Ransomware is a type of malicious program or malware that threatens to destroy or block access to important data or systems until a ransom is paid by the victim. Ransomware can infect computers in various ways, for example through attached files that the victim downloads, or attacking software directly by looking for vulnerable loopholes. Ransomware attacks have caused many losses, especially in the banking sector, both in terms of financial and customer data security. Protection of banking services from cyber attacks is very important. Proactive prevention efforts, early detection, quick response, application of appropriate technology and implementation of strong data security policies are crucial elements in maintaining the integrity and security of financial transactions. Therefore, it is very important for banking services to understand ransomware attacks and the dangers of ransomware by strengthening computer data security. The research method used is descriptive qualitative research using the literature study method.

This study aims to develop a web-based malware detection system using Convolutional Neural Network (CNN) utilizing the IoT23 dataset. Malware is malicious software that can exploit security vulnerabilities in computer systems, steal data, and degrade performance. The implementation of this detection system involves CNN, capable of extracting important features from both visual and textual data, applied to malware classification. The IoT23 dataset comprises 23 scenarios of IoT network traffic, including traffic from malware-infected devices. The study results show that the developed web application can detect malware attacks with accuracy, precision, recall, and F1-score of 99% on separate data scenarios. This CNN-based detection system has proven effective in identifying and classifying malware attacks, contributing to the enhancement of network and device security.  

This article discusses challenges and solutions related to cybersecurity in e-commerce transactions. With the rapid growth of e-commerce, cybersecurity has become a critical issue that needs to be taken seriously. Cybersecurity challenges in e-commerce transactions include threats such as identity theft, malware attacks, phishing attacks, and data breaches. This article identifies and analyzes some of the cybersecurity challenges faced by e-commerce transactions. These challenges include technological infrastructure vulnerabilities, user non-compliance with good security practices, and a lack of effective detection and response systems to evolving threats. Next, this article presents solutions that can be implemented to overcome cyber security challenges in e-commerce transactions. These solutions include implementing strong data encryption, the use of dual authentication, security training for users, proactive threat monitoring and detection, and increased compliance with security standards. In this article, we also discuss the need for collaboration between governments, e-commerce companies and users to create a better security environment. This collaboration involves exchanging information, establishing appropriate policies, and increasing awareness of the importance of cyber security in e-commerce transactions.