Analisis Deteksi Malware Menggunakan Pendekatan Static dan Dynamic pada Mendeley Dataset
DOI:
https://doi.org/10.35889/jutisi.v15i4.4092Keywords:
Malware, Static Analysis, Dynamic Analysis, Random Forest, Klasifikasi MalwareAbstract
The increasing complexity of malware requires analytical methods capable of comprehensively identifying file characteristics and network behavior. This study aims to analyze malware characteristics and classify its risk level using a combination of static analysis and dynamic analysis on the Malware Analytics Dataset from the Mendeley Data Repository. Dataset [1] consists of 2,000 malware samples with 32 attributes representing file structures and network activities. Static features describe file characteristics without execution, while dynamic features represent network behavior during malware execution in a sandbox environment. The score attribute is used to construct proxy labels for high- and low-risk categories, and the dataset is divided into 80% training data and 20% testing data. Classification is performed using the Random Forest algorithm. The results show that DNS Request appears in 68% of samples, HTTP Communication in 54%, Host Communication in 49%, and UDP Activity in 32%. The model achieves 88.75% accuracy, 84.57% precision, 87.26% recall, and an F1-score of 85.89%. The combination of static and dynamic features can be used to classify malware risk levels with good performance.
Keywords: Malware; Static Analysis; Dynamic Analysis; Random Forest; Malware Classification; Network Security.
Abstrak
Perkembangan malware yang semakin kompleks menuntut metode analisis yang mampu mengidentifikasi karakteristik file dan perilaku jaringan komprehensif. Penelitian ini bertujuan menganalisis karakteristik malware dan mengklasifikasikan risikonya menggunakan kombinasi static analysis dan dynamic analysis pada Malware Analytics Dataset dari Mendeley Data Repository. Dataset [1] terdiri atas 2.000 sampel malware dengan 32 atribut yang merepresentasikan struktur file dan aktivitas jaringan. Fitur statis menggambarkan karakteristik file tanpa eksekusi, sedangkan fitur dinamis merepresentasikan perilaku jaringan selama malware dijalankan pada lingkungan sandbox. Atribut score digunakan untuk membentuk label proxy risiko tinggi dan rendah, kemudian dataset dibagi menjadi 80% data training dan 20% data testing. Klasifikasi dilakukan menggunakan algoritma Random Forest. Hasil analisis menunjukkan DNS Request muncul pada 68% sampel, HTTP Communication 54%, Host Communication 49%, dan UDP Activity 32%. Hasil pengujian menghasilkan accuracy 88,75%, precision 84,57%, recall 87,26%, dan F1-score 85,89%. Kombinasi fitur statis dan dinamis dapat digunakan untuk mengklasifikasikan tingkat risiko malware dengan performa yang baik.
References
[1] O. Oudat, “Malware Analytics Dataset,” 2024, Mendeley Data. doi: 10.17632/tz6vfjm93h.3.
[2] M. Rahman, “Hybrid Malware Detection Using Static and Dynamic Analysis Techniques,” J. Netw. Comput. Appl., vol. 207, p. 103481, 2022.
[3] A. Kamdan, “Static Malware Detection and Classification Using Machine Learning Techniques,” Appl. Sci., vol. 15, no. 3, p. 1120, 2025.
[4] E. Amer, A. Alqahtani, and M. Khan, “Graph-Based Malware Detection Using Dynamic Analysis,” Expert Syst. Appl., vol. 237, p. 120427, 2025.
[5] O. Aslan and R. Samet, “A Comprehensive Review on Malware Detection Approaches,” IEEE Access, vol. 8, pp. 6249–6271, 2020, doi: 10.1109/ACCESS.2019.2963724.
[6] S. Al-Ahmadi, “A Comparative Study of Static and Dynamic Malware Analysis Techniques,” J. Inf. Secur. Appl., vol. 74, p. 103457, 2023.
[7] M. M. Qusyairi, R. G. Utomo, and R. Yasirandi, “Malware Detection on Static Analysis Windows Portable Executable (PE) Using Support Vector Machine and Decision Tree,” CSRID (Computer Sci. Res. Its Dev. Journal), vol. 15, no. 2, pp. 93–102, 2023, doi: 10.22303/csrid.15.2.2023.93-102.
[8] A. R. Damanik, H. B. Seta, and T. Theresiawati, “Analisis Trojan Dan Spyware Menggunakan Metode Hybrid Analysis,” J. Ilm. Matrik, vol. 25, no. 1, pp. 89–97, 2023, doi: 10.33557/jurnalmatrik.v25i1.2327.
[9] N. Widiyasono, H. Mubarok, and A. Fatwa MF, “Analisis Malware Ahmyth pada Platform Android Menggunakan Metode Reverse Engineering,” Gener. J., vol. 6, no. 2, pp. 73–82, 2022, doi: 10.29407/gj.v6i2.17749.
[10] V. R. Sianipar and H. Pangaribuan, “Analisis Dan Deteksi Malware Pada Protokol Jaringan Menggunakan Metode Malware Analisis Dinamis Dan Malware Analisis Statis,” Comput. Sci. Ind. Eng., vol. 9, no. 6, pp. 790–797, 2023, doi: 10.33884/comasiejournal.v9i6.7833.
[11] S. Hussain, “Hybrid Malware Detection Framework Based on Static and Dynamic Features,” J. Cyber Secur. Mobil., vol. 13, no. 2, pp. 215–230, 2024.
[12] S. Altaha and M. Ahmed, “Machine Learning in Malware Analysis: Current Trends and Future Directions,” Int. J. Adv. Comput. Sci. Appl., vol. 15, no. 1, pp. 312–321, 2024.
[13] Y. B. Fitriana, S. Esabela, and F. Hamdani, “Deteksi Serangan Malware Pada Web Aplikasi Menggunakan Metode Malware Analisis Dinamis dan Statis,” Digit. Transform. Technol., vol. 4, no. 1, pp. 461–470, 2024, doi: 10.47709/digitech.v4i1.4270.
[14] I. M. M. Matin, M. Agustin, B. Sugiarto, and A. N. Asri, “Deteksi Malware Menggunakan Machine Learning dengan Metode Ensemble,” 2023. doi: 10.36499/psnst.v13i1.9224.
[15] D. W. Asry, E. Siswanto, and D. Kurniawan, “Deteksi Malware Statis Menggunakan Deep Neural Networks Pada Portable Executable,” Tek. J. Ilmu Tek. dan Inform., vol. 3, no. 1, pp. 19–34, 2023.
[16] Y. B. Setiadji, D. F. Priambodo, M. Hasbi, and F. I. Sabila, “Identifikasi Malware Berdasarkan Artefak Registry Windows 10 Menggunakan Regshot dan Cuckoo,” JEPIN (Jurnal Edukasi dan Penelit. Inform., vol. 8, no. 3, pp. 482–491, 2022.
[17] Y. W. Sitorus, P. Sukarno, and S. Mandala, “Analisis Deteksi Malware Android menggunakan Metode Support Vector Machine & Random Forest,” e-Proceeding Eng., vol. 8, no. 6, 2021.
[18] R. Sharma and N. Gupta, “Network Behavior-Based Malware Detection Using Machine Learning Algorithms,” IEEE Access, vol. 12, pp. 42145–42159, 2024.
[19] J. Song, “Artificial Intelligence-Based Malware Detection Methods for Cybersecurity,” Futur. Gener. Comput. Syst., vol. 147, pp. 109–121, 2024.
[20] Khalda and Wibowo, “Analisis Perilaku Malware Menggunakan Pendekatan Analisis Statis dan Dinamis,” J. Sains, Nalar, dan Apl. Teknol. Inf., vol. 4, no. 1, 2025.
[21] R. R. Sani, F. A. Rafrastara, and W. Ghozi, “Integrating Ensemble Learning and Information Gain for Malware Detection based on Static and Dynamic Features,” Kinet. Game Technol. Inf. Syst. Comput. Network, Comput. Electron. Control, vol. 10, no. 1, 2025, doi: 10.22219/kinetik.v10i1.2051.
[22] D. Z. Syeda and M. N. Asghar, “Dynamic Malware Classification and API Categorisation of Windows Portable Executable Files Using Machine Learning,” Appl. Sci., vol. 14, no. 3, p. 1015, 2024, doi: 10.3390/app14031015.
