Indonesian Journal of Cybersecurity and Emerging Risks
ndonesian Journal of Cybersecurity and Emerging Risks (IJCYBER, Indones. J. Cybersecur. Emerg. Risks, e-ISSN 3164-7782) is a peer-reviewed international journal dedicated to advancing research on theoretical developments and practical implementations in the dynamic fields of cybersecurity, digital risk management, and emerging technological threats, published by the Indonesian Artificial Neural Network Society (IdNNS). The journal is committed to maintaining high ethical standards in scholarly publishing and adheres to established guidelines for research integrity and publication ethics. It aims to advance knowledge and best practices for identifying, analyzing, and mitigating emerging risks in cyberspace, while promoting collaboration among academia, government, and industry to strengthen digital security at national and global levels. The IJCYBER provides a scientific platform for researchers, academics, practitioners, policymakers, and industry professionals to present innovative ideas, methodologies, and solutions to address evolving challenges in cyberspace and digital infrastructure. The journal welcomes original research articles, review papers, technical reports, and case studies that advance understanding and practical implementation of cyber resilience, risk mitigation strategies, and secure digital ecosystems in both the public and private sectors. IJCYBER focuses on interdisciplinary research exploring new and emerging risks arising from technological advancements, including cyber threats, artificial intelligence risks, vulnerabilities in digital transformation, and critical infrastructure security. The scope of the journal includes, but is not limited to: Advanced cybersecurity, technical implementation, and infrastructure: Secure digital ecosystems, cyber resilience engineering (protocols, frameworks, and technologies), infrastructure protection, and threat detection; Digital risk management and governance: Risk framework, mitigation strategies, vulnerability assessments, and policy and compliance; Emerging technologies and AI threats: Artificial intelligence risks, next-gen vulnerabilities, and evolving attack vectors; Interdisciplinary and strategic collaboration: Triple-helix collaboration (among academia, government, and industry), public policy and geopolitical studies on strengthening digital borders and cross-border threat intelligence, and socio-technical studies on the human element of cybersecurity, security culture, and insider threat mitigation.
Articles
10 Documents
<![CDATA[STUN-based Detection of DSCP Mangling ]]>
<![CDATA[Ahmad Irfan Nabihan Shukri]]>;
<![CDATA[Muhammad Zaid Mohd Riduan]]>;
<![CDATA[Adamu Abubakar Ibrahim]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 1 (2026): 2026: IJCYBER Volume 1 Issue 1 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Differentiated Services Code Point (DSCP) is a field in the IP header used to classify and manage network traffic based on quality of service (QoS) requirements. However, malicious actors and misconfigured network devices can manipulate DSCP values, a practice known as DSCP mangling to evade traffic shaping policies, degrade service quality or bypass security controls. This paper explores and proposes an algorithm-based approach to detect DSCP mangling in real time network traffic. By improving traffic flow analysis, statistical modeling and anomaly detection techniques, the proposed system identifies inconsistencies between expected and observed DSCP markings. The STUN-based algorithm detects inconsistencies between declared and observed DSCP values along the network path. The algorithm also generates a fingerprint and compares the existent fingerprint packet within the database. This approach can enhance the integrity of QoS enforcement and contributes to improved security and reliability in IP networks.]]>
<![CDATA[Ransomware Detection Using Light Gradient Boosting Machine Classifier ]]>
<![CDATA[Abdullah Said Alkalbani]]>;
<![CDATA[Deni Mulyana]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 1 (2026): 2026: IJCYBER Volume 1 Issue 1 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Ransomware continues to represent a critical cybersecurity threat across various sectors, leading to significant financial and operational disruptions. Traditional detection techniques, such as signaturebased and behavior-based approaches, often fall short in identifying advanced ransomware variants that utilize polymorphism, obfuscation, and zero-day exploits. To overcome these limitations, this study proposes a machine learning-based framework for multi-class ransomware detection using the Light Gradient Boosting Machine (LightGBM) classifier. The model was trained and evaluated on a labeled Android dataset comprising diverse ransomware families alongside benign applications. To address the issue of class imbalance, the Synthetic Minority Oversampling Technique with Edited Nearest Neighbors (SMOTEENN) was employed, followed by thorough feature preprocessing and hyperparameter optimization. The optimized LightGBM model achieved an accuracy of 90.78% and a weighted F1-score of 90.73%, outperforming baseline classifiers such as Decision Tree and Random Forest. This study offers both theoretical and practical contributions by presenting a lightweight yet highly accurate detection system suitable for real-world deployment, and by validating the effectiveness of SMOTEENN when combined with LightGBM for handling imbalanced, multiclass cybersecurity datasets.]]>
<![CDATA[Enhancing web defense through machine learning and active response mechanism integration in WAF ]]>
<![CDATA[Antonio Varialle]]>;
<![CDATA[Gerard Borg]]>;
<![CDATA[Agung Prasetiawan]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 1 (2026): 2026: IJCYBER Volume 1 Issue 1 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Web applications are vital in today's digital infrastructure, offering fast and flexible access to services and information. However, they face security challenges due to increasingly sophisticated cyber attacks. This study addresses the problem of conventional Web Application Firewalls (WAFs) struggling to adapt to evolving threats like zero-day attacks because of their reliance on static rules and ssignatures. We propose a novel approach that integrates machine learning and active response mechanisms to enhance WAF adaptability. The methodology involves training a machine learning model on diverse datasets to identify and categorize malicious activities, ensuring robustness against various attack scenarios. Additionally, we develop a library to predict future attack patterns, facilitating an active response system. The results demonstrate improved detection and response to current and future threats by combining supervised and unsupervised learning for both initial training and ongoing adaptation, effectively enhancing WAF capabilities.]]>
<![CDATA[Machine Learning-Based Detection of Cross-Site Scripting (XSS) Attacks Using Classification Algorithms ]]>
<![CDATA[Anupama Mishra]]>;
<![CDATA[Pramod Kumar]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 1 (2026): 2026: IJCYBER Volume 1 Issue 1 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Cross-Site Scripting (XSS) attack is the most dominant attack in web applications. Its empowering attackers to inject malicious scripts into trusted web environments. The research paper proposed a machine learning-based framework for the detection and classification of XSS attacks. We use the dataset from Kaggle that contains textual web request patterns labeled as normal and malicious instances. Experimental analysis was performed to evaluate the effectiveness of multiple supervised learning algorithms including Logistic Regression, Random Forest, and Support Vector Machine. The methodology involved preprocessing, feature extraction, model training, testing, and performance evaluation parameters for binary classification.]]>
<![CDATA[Explainable Deep Learning for Network Attack Detection and Classification: A SHAP-Based Interpretation Framework ]]>
<![CDATA[Anupama Mishra]]>;
<![CDATA[Pramod Ganesh Kumar]]>;
<![CDATA[Vinay Rishiwal]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 1 (2026): 2026: IJCYBER Volume 1 Issue 1 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[There are many attacks on network such as DNS, LDAP, MSSQL, NTP, NetBIOS, PortMap, SNMP, and DDoS. Among all Distributed Denial-of-Service (DDoS) attacks are major security threats in networks. These attacks affect the availability and performance of network services. Traditional intrusion detection methods often face difficulties in identifying different types of attacks accurately. In our research paper, a framework based on an explainable deep learning is proposed to detect and predict multi-classification DDoS attacks. Here, we used the CIC-DDoS2019 dataset for experimentation. Initially, data preprocessing and feature selection are carried out using the Random Forest technique to identify important network traffic features. The selected features are then provided to a hybrid model mix of Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) model for classification. The results we achieve as accuracy of 75.39% and a weighted F1-score of 72%. SHAP analysis is applied to explain the prediction results. The tool is used to enhance the interpretability of the model. The analysis shows that Flow Bytes/s, Flow IAT Std, and Fwd Packets Length Total are the most important features for attack detection. The proposed approach provides effective classification along with better understanding of model decisions.]]>
<![CDATA[ACCURACY COMPARISON OF HYBRID CNNBILSTM AND MACHINE LEARNING MODELS IN ANDROID MALWARE DETECTION ]]>
<![CDATA[ahmad muzakir]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Malware is malicious software designed to damage computer and mobile devices by accessing, stealing personal information, or taking control of devices through networks. This threat is grave on Android platforms, as it can disrupt device performance and compromise user data. Therefore, effective and reliable malware detection methods are required. This research aims to develop and evaluate a malware detection method for Android devices using a Hybrid Convolutional Neural Network (CNN+BiLSTM) approach. The dataset used in this study was sourced from TUANDROMD (Tezpur University Android Malware Dataset). The results indicate that the Hybrid CNN-BiLSTM method achieves a higher accuracy than other machine learning methods. These findings suggest that this hybrid approach is one of the solutions that can be used to improve the security of Android devices against malware attacks compared to CNN and other machine learning methods in this study.]]>
<![CDATA[Analyzing Malware: A Comparative Study of Static and Dynamic Methods through Reverse Engineering ]]>
<![CDATA[Fransiskus Krismayandri Ekaristi]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Malware remains a critical and evolving threat to modern computing environments, necessitating advanced defensive strategies from cybersecurity professionals. This study explores malware analysis through both static and dynamic approaches within a Windows-based environment, emphasizing the role of reverse engineering. Static analysis involves inspecting malware binaries, structure, and metadata without execution. Tools such as IDA Pro and CFF Explorer allow analysts to uncover embedded exploits, operational logic, and potential payloads, offering deep structural insight into the malware’s functionality.In contrast, dynamic analysis focuses on observing malware behaviour in real time by executing it within an isolated virtual machine. This method, supported by tools like Process Monitor (ProcMon), enables analysts to track runtime activities, such as API calls, file system alterations, registry modifications, and network interactions. The integration of these tools provides a comprehensive view of malware behaviour, both at the static and operational levels.The paper also highlights the growing sophistication of malware, which increasingly employs obfuscation and evasion techniques. Thus, combining static and dynamic analyses— augmented by antivirus tools and SIEM platforms like Wazuh—enhances detection capabilities. The study concludes that a hybrid reverse engineering strategy significantly strengthens malware defence, offering actionable recommendations to reduce future threats within enterprise-level Windows environments. Keyword—Malware,Reverse Engineering, Static analysis, Dynamic Analysis]]>
<![CDATA[INTEGRATING OPEN-SOURCE TOOLS INTO A BUG BOUNTY SYSTEM FOR NETWORK INFRASTRUCTURE VULNERABILITY DETECTION ]]>
<![CDATA[Ravenala Chabib Assyfa]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[In the evolving landscape of cybersecurity, efficient and accurate detection of network vulnerabilities is critical, especially in the context of bug bounty programs. This research presents the development of an integrated, open-source-based vulnerability detection system that combines Sublist3r, Nuclei, and Dalfox into a unified, automated platform. The system is built using a Flask backend and a React.js-based graphical user interface to streamline subdomain enumeration, CVE-based scanning, and Cross-Site Scripting (XSS) detection. Benchmark tests conducted across nine domains demonstrate a significant reduction in execution time (21.8 seconds average), an accuracy rate above 85%, and a System Usability Scale (SUS) score of 82.5, categorized as "Excellent." Compared to manual workflows, the integrated system improves operational speed, consistency, and user accessibility. This study contributes a modular and scalable solution for vulnerability assessments, especially suited for educational, research, and small enterprise envi]]>
<![CDATA[Beyond DQN: A Comparative Analysis of Advanced Deep Reinforcement Learning Algorithms for Cost-Aware Intrusion Detection ]]>
<![CDATA[Hina Javed]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[It is a comparative study of six Deep Reinforcement Learning (DRL) algorithms namely Deep Q-Network (DQN), Double Deep Q-Network (DDQN), Dueling Double Deep Q-Network (D3QN), REINFORCE, Advantage Actor-Critic (A2C), Proximal Policy Optimization (PPO), with statistical validation, multi-dataset evaluation and extensive performance analysis in the context of cost-aware intrusion detection in extreme class imbalance. All DRL agents employed a fixed CNN – LSTM feature extractor and prioritized experience replay (PER) in the controlled experimental setup. They tested the three benchmark datasets, CSE-CIC-IDS2018, CIC-IDS2017 and UNSW-NB15. Asymmetric reward function was used to train each DRL agent. There were 10 runs of the simulation with different random seeds, for which Wilcoxon signed-rank tests and McNemar's tests were performed to test the statistical significance. Key performance measures included recall, alerts per million flows (ARMF), Precision-Recall AUC (PR-AUC), training convergence, inference latency, and computational complexity. At 1,247 ARMF, PPO is statistically more successful (p=0.002, Wilcoxon) than baseline DQN+PER with a mean recall of 93.55% (sigma=0.82). The most balanced D3QN solution was found to be 92.80% recall (sigma=0.76) at 1,105 ARMF. For all DRL methods with PER, the number of alerts was reduced by 28-32x compared to supervised baselines. The generalization was confirmed by cross-dataset validation, where PPO achieved 90.20% recall on CIC-IDS2017 and 87.80% on UNSW-NB15. All value-based methods were shown to be statistically significant (p<0.05). The average of the inference latency was still under 2ms per sample. The results provide guidelines for algorithm selection in SOC deployments. The multi-class and zero-day detection scenarios have not been studied. Only 3 data sets and fixed feature backbone are used in the study. This study statistically compares and contrasts six of the most prominent DRL algorithms for cost-aware intrusion detection with confidence intervals, effect sizes and also reproducibility analysis.]]>
<![CDATA[Ensuring High Performance During Implementation of Security Algorithms on FPGA ]]>
<![CDATA[Neeraj Bisht]]>;
<![CDATA[Shilpi Bisht]]>;
<![CDATA[Sandeep K. Budhani]]>
<![CDATA[ Indonesian Journal of Cybersecurity and Emerging Risks Vol. 1 No. 2 (2026): 2026: IJCYBER Volume 1 Issue 2 Year 2026 ]]>
Publisher : <![CDATA[Indonesian Artificial Neural Network Society ]]>
Show Abstract
|
Download Original
|
Original Source
|
Check in Google Scholar
<![CDATA[Cryptography has evolved into an indispensable component of modern technology. To ensure the safety and security of our critical data, which is easily accessible with a single click, it is critical to choose. In addition, comparative research is conducted using the experimental results for various critical adequate, efficient, and viable cryptographic methods. Two widely used cryptography algorithms are the Advanced Encryption Standard and the Data Encryption Standard. The AES and DES algorithms are implemented in FPGA for the Kintex-7 Low voltage at three different frequencies in this study. This research aims to determine which cryptographic method consumes the least amount of power and occupies the least amount of space. It is observed through experimental results that DES consumed 501% more total on-chip power; produced 9.8 % higher junction temperature; required 513 % more Slice LUTs, 294% more Slice Registers, and 373 % more Slices than AES implementation for Kintex-7 Low Voltage at 1.6 GHz frequency. This study indicates that the AES implementation for the Kintex-7 Low Voltage at 1.6 GHz was the most energy and area efficient algorithm, outperforming the DES implementation for the same setup.]]>
