Domain Adaptation untuk Deteksi Malware Lintas Sistem Operasi

Dzulfikar, Muhammad Farhan (2026) Domain Adaptation untuk Deteksi Malware Lintas Sistem Operasi. Other thesis, Institut Teknologi Sepuluh Nopember.

Text 5025221011-Ungergraduate_Thesis.pdf - Accepted Version Restricted to Repository staff only Download (2MB) | Request a copy

Abstract

Sistem deteksi malware berbasis pembelajaran mesin yang memanfaatkan fitur hasil dynamic analysis sering mengalami penurunan kinerja ketika diterapkan pada lingkungan eksekusi yang berbeda akibat perbedaan distribusi data (domain shift), seperti perbedaan versi sistem operasi Windows. Penelitian ini menerapkan metode domain adaptation berbasis transformasi linier untuk menyelaraskan representasi fitur antara domain sumber dan domain target pada tugas klasifikasi malware. Penelitian ini menggunakan dataset perilaku malware berbasis pemanggilan API Windows yang telah diproses sebelumnya dan direpresentasikan dalam bentuk vektor frekuensi. Proses domain adaptation dilakukan dengan menggunakan pendekatan least squares untuk membangun matriks transformasi fitur antardomain dan regularisasi Ridge Regression (L2). Pada tahap klasifikasi, penelitian ini menggunakan pendekatan ensemble classifier yang mengombinasikan beberapa model Gradient Boosting Decision Tree, yaitu LightGBM, XGBoost, dan CatBoost, guna meningkatkan stabilitas dan akurasi prediksi dibandingkan dengan penggunaan classifier tunggal. Evaluasi dilakukan menggunakan metrik akurasi, presisi, recall, dan F1-score pada data uji domain target untuk menilai efektivitas domain adaptation serta kontribusi pendekatan ensemble dalam meningkatkan kinerja deteksi malware lintas domain.
======================================================================================================================================
Machine learning–based malware detection systems that utilise features extracted from dynamic analysis often suffer from performance degradation when deployed in different execution environments due to distributional differences (domain shift), such as variations across Windows operating system versions. This study applies a linear transformation–based domain adaptation approach to align feature representations between the source and target domains for malware classification. The dataset consists of Windows API call behaviour features obtained via dynamic analysis, represented as frequency-based feature vectors. Domain adaptation is performed using a least squares approach to estimate a feature transformation matrix between domains and also ridge regression. For the classification stage, this study employs an ensemble classifier that combines multiple Gradient Boosting Decision Tree models, namely LightGBM, XGBoost, and CatBoost, to improve prediction stability and accuracy compared to single-classifier approaches. Model performance is evaluated on target domain test data using accuracy, precision, recall, and F1-score metrics to assess both the effectiveness of domain adaptation and the contribution of the ensemble approach in improving cross-domain malware detection performance.

Item Type:	Thesis (Other)
Uncontrolled Keywords:	Deteksi Malware, Dynamic Analysis, Domain Adaptation, Domain Shift, Ensemble Learning, Least Squares, Ridge Regression, Gradient Boosting, LightGBM, XGBoost, CatBoost
Subjects:	T Technology > T Technology (General)
Divisions:	Faculty of Intelligent Electrical and Informatics Technology (ELECTICS) > Informatics Engineering > 55201-(S1) Undergraduate Thesis
Depositing User:	Muhammad Farhan Dzulfikar
Date Deposited:	23 Jul 2026 04:29
Last Modified:	23 Jul 2026 04:29
URI:	http://repository.its.ac.id/id/eprint/137160

Actions (login required)

View Item