Muh. Ikhsan Amar
Institut Teknologi Bacharuddin Jusuf Habibie

Published : 2 Documents Claim Missing Document
Claim Missing Document
Check
Articles

Found 2 Documents
Search

Investigating LOLBAS-Based Malware Using Hybrid Analysis: A Case Study of PowerShell-Driven Fileless Execution Rosmiati Rosmiati; Muh. Ikhsan Amar; Muhammad Arham Arsyad; Hariani Hariani
Journal of System and Computer Engineering Vol 7 No 2 (2026): JSCE: April 2026
Publisher : Universitas Pancasakti

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.61628/jsce.v7i2.2623

Abstract

This study aims to identify and understand the technical characteristics of the malware output.exe, obtained from the MalwareBazaar repository, through a hybrid reverse engineering approach. This method combines static and dynamic analyses to provide a comprehensive understanding of the malware’s internal structure, execution behavior, and evasion techniques. Static analysis revealed the invocation of system functions such as CreateProcessW and RegSetValueExA, as well as the use of syscall to execute PowerShell commands directly, indicating the implementation of the LOLBAS (Living off the Land Binaries and Scripts) technique. Dynamic analysis using CAPE Sandbox confirmed the malware’s actual behavior, including process injection into legitimate processes such as svchost.exe, launching powershell.exe for data compression, and establishing network communication via Discord Webhook for data exfiltration. Integration of both analyses shows that output.exe functions as an information stealer with fileless execution and advanced persistence mechanisms. These findings demonstrate that the hybrid analysis approach is effective in identifying modern malware that leverages legitimate system components to evade traditional signature-based detection methods.
Attention-Driven Contrastive Learning for the Identification of Rare Partial Discharge Signal in GIS Muhaimin Hading; Herviana Herviana; Muh. Ikhsan Amar; A. Syahrinaldy Syahruddin; Muhammad Irsan; Aulia Salsabila R.H
Journal of System and Computer Engineering Vol 7 No 3 (2026): JSCE: July 2026
Publisher : Universitas Pancasakti

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.61628/jsce.v7i3.2664

Abstract

Gas-insulated switchgear (GIS) is a critical component in high-voltage power transmission systems, where partial discharge (PD) activity can indicate early-stage insulation defects. However, phase-resolved partial discharge (PRPD)-based fault diagnosis remains challenging due to noisy signals, perturbed measurement conditions, and severe class imbalance, particularly for rare floating-electrode defects. This study proposes an attention-driven contrastive learning framework for rare PD signal identification in GIS. PRPD data are represented as two-dimensional density matrices derived from phase angle, discharge magnitude, and occurrence count. The proposed framework applies PRPD-specific data augmentation, followed by ResUNet-based denoising, CBAM-based feature refinement, and supervised contrastive learning to improve feature separability among PD classes. The framework was evaluated using a public 550 kV GIS PRPD dataset containing corona-type, surface-type, floating-electrode-type, and noise classes. The results show that augmentation substantially improved robustness. When trained with raw data, the proposed model achieved 91.90% accuracy and 53.81% F1-score under the original test scenario, but decreased to 48.76% accuracy and 46.26% F1-score under IEC-perturbed testing. After augmentation, the model achieved 98.24% accuracy and 96.58% F1-score under the original scenario, and maintained 97.44% accuracy and 97.76% F1-score under IEC perturbation. These findings indicate that the proposed framework supports robust PRPD representation learning for GIS PD diagnosis under perturbed and imbalanced conditions.