Claim Missing Document
Check
Articles

Found 2 Documents
Search
Journal : Mobile and Forensics

Digital Forensics on APK Files: A Combined Approach Using MobSF and GHIDRA Fariz Maulana Rizki; Mukhlis Prasetyo Aji; Ermadi Satriya Wijaya; Harjono
Mobile and Forensics Vol. 7 No. 2 (2025)
Publisher : Universitas Ahmad Dahlan

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.12928/mf.v7i2.14088

Abstract

The rapid growth of Android smartphones has increased user convenience but also elevated the risk of cybercrime, especially malware attacks using complex obfuscation techniques that hinder detection and analysis. Traditional methods are often insufficient to address these evolving threats. This study integrates automated and manual analysis on APK files using Mobile Security Framework (MobSF) and GHIDRA through reverse engineering. MobSF performs automated static analysis to identify vulnerabilities and security indicators, while GHIDRA is used to decompile binary code into pseudocode for in-depth manual verification. The analysis of the “Pencairan Hadiah” (Prize Disbursement) application revealed dangerous permissions such as RECEIVE_SMS, READ_PHONE_STATE, and SYSTEM_ALERT_WINDOW. Manual inspection with GHIDRA confirmed API calls like getImei() and access to the Telegram API for automated data transmission. Although the bot token was inactive, the findings indicate an intent to exfiltrate sensitive data. The integration of MobSF and GHIDRA provides a deeper understanding and concrete evidence of malicious behavior in APK files, demonstrating the effectiveness of combining automated and manual approaches in digital forensic analysis.
Performance Analysis of Random Forest Algorithm with Smote for Multi-Class Attack Detection Komalasari, Ratna; Aji, Mukhlis Prasetyo; Wicaksono, Agung Purwo; Fitriani, Maulida Ayu
Mobile and Forensics Vol. 8 No. 1 (2026)
Publisher : Universitas Ahmad Dahlan

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.12928/mf.v8i1.14584

Abstract

The increasing sophistication of cyberattacks necessitates the development of detection systems capable of accurately identifying various threat types. Data imbalance within attack logs presents a substantial challenge that can undermine the effectiveness of detection models. This study introduces a multi-class cyberattack detection model employing the Random Forest algorithm, optimized through the Synthetic Minority Over-sampling Technique (SMOTE) to address data imbalance. The innovative aspect of this research lies in integrating Random Forests and SMOTE to improve multi-class classification accuracy on local attack log datasets. This approach remains sparsely explored in academic research. The dataset consists of 3000 cyberattack logs from the Information Systems Bureau of Muhammadiyah University Purwokerto, spanning 10 cyberattack categories. The research process involved data collection, pre- processing, division, model training, and evaluation. Results indicate that the model achieved an average F1-macro score of 76% and a weighted average of 93%, with the " Threat Level Medium " feature identified as the most influential predictor. These findings suggest that the combination of Random Forest and SMOTE effectively enhances multi-class detection performance and presents promising prospects for log-based cybersecurity systems in educational and industrial environments.