Analisis Deteksi Malware Menggunakan Pendekatan Static dan Dynamic pada Mendeley Dataset

Kurniawan, Erwin Dwi
Ariyanto, Lilik
Rozzaqi, Ade Ricky

Jutisi: Jurnal Ilmiah Teknik Informatika dan Sistem Informasi
Vol. 15 No. 4 (2026): Agustus 2026

The increasing complexity of malware requires analytical methods capable of comprehensively identifying file characteristics and network behavior. This study aims to analyze malware characteristics and classify its risk level using a combination of static analysis and dynamic analysis on the Malware Analytics Dataset from the Mendeley Data Repository. Dataset [1] consists of 2,000 malware samples with 32 attributes representing file structures and network activities. Static features describe file characteristics without execution, while dynamic features represent network behavior during malware execution in a sandbox environment. The score attribute is used to construct proxy labels for high- and low-risk categories, and the dataset is divided into 80% training data and 20% testing data. Classification is performed using the Random Forest algorithm. The results show that DNS Request appears in 68% of samples, HTTP Communication in 54%, Host Communication in 49%, and UDP Activity in 32%. The model achieves 88.75% accuracy, 84.57% precision, 87.26% recall, and an F1-score of 85.89%. The combination of static and dynamic features can be used to classify malware risk levels with good performance. Keywords: Malware; Static Analysis; Dynamic Analysis; Random Forest; Malware Classification; Network Security. Abstrak Perkembangan malware yang semakin kompleks menuntut metode analisis yang mampu mengidentifikasi karakteristik file dan perilaku jaringan komprehensif. Penelitian ini bertujuan menganalisis karakteristik malware dan mengklasifikasikan risikonya menggunakan kombinasi static analysis dan dynamic analysis pada Malware Analytics Dataset dari Mendeley Data Repository. Dataset [1] terdiri atas 2.000 sampel malware dengan 32 atribut yang merepresentasikan struktur file dan aktivitas jaringan. Fitur statis menggambarkan karakteristik file tanpa eksekusi, sedangkan fitur dinamis merepresentasikan perilaku jaringan selama malware dijalankan pada lingkungan sandbox. Atribut score digunakan untuk membentuk label proxy risiko tinggi dan rendah, kemudian dataset dibagi menjadi 80% data training dan 20% data testing. Klasifikasi dilakukan menggunakan algoritma Random Forest. Hasil analisis menunjukkan DNS Request muncul pada 68% sampel, HTTP Communication 54%, Host Communication 49%, dan UDP Activity 32%. Hasil pengujian menghasilkan accuracy 88,75%, precision 84,57%, recall 87,26%, dan F1-score 85,89%. Kombinasi fitur statis dan dinamis dapat digunakan untuk mengklasifikasikan tingkat risiko malware dengan performa yang baik.