Di era transformasi digital yang pesat, perangkat lunak telah menjadi komponen penting di berbagai sektor. Namun, di lain sisi perangkat lunak juga semakin menjadi sasaran ancaman keamanan siber. Salah satu ancaman yang paling mengkhawatirkan adalah backdoor, yaitu kerentanan tersembunyi yang disisipkan secara tidak sah ke dalam perangkat lunak sehingga memungkinkan akses tanpa izin dengan menghindari mekanisme keamanan tradisional. Penelitian ini bertujuan mengembangkan metode deteksi backdoor yang lebih akurat dan komprehensif melalui integrasi Static Code Analysis dan Software Component Analysis. Representasi fitur dilakukan menggunakan Term Frequency–Inverse Document Frequency (TF-IDF), kemudian digunakan sebagai masukan bagi beberapa algoritma Machine Learning dan Deep Learning, yaitu Logistic Regression, K-Nearest Neighbor (KNN), Random Forest, Decision Tree, Gradient Boosting, XGBoost, LightGBM, AdaBoost, Multi-Layer Perceptron (MLP), dan Long Short-Term Memory (LSTM). Dataset penelitian terdiri atas 128 sampel source code, yang mencakup 60 sampel backdoor dan 68 sampel benign, dikumpulkan dari repositori publik serta dikurasi secara manual untuk menjamin kualitas dan relevansinya. Hasil eksperimen menunjukkan bahwa XGBoost dan KNN memperoleh akurasi tertinggi sebesar 96,15%, diikuti oleh MLP, LSTM, dan AdaBoost dengan akurasi 92,31%. Temuan ini menunjukkan bahwa integrasi analisis statis, inspeksi kerentanan berbasis komponen, dan teknik Machine Learning mampu meningkatkan efektivitas deteksi backdoor. Selain itu, pendekatan yang diusulkan berpotensi mendukung implementasi deteksi backdoor secara otomatis pada pipeline DevSecOps untuk meningkatkan keamanan perangkat lunak sebelum tahap deployment. Abstract In the era of rapid digital transformation, software has become a critical component across various sectors. However, it has also become an increasingly attractive target for cybersecurity threats. One of the most concerning threats is the backdoor, a hidden vulnerability that is illicitly inserted into software, enabling unauthorized access while bypassing traditional security mechanisms. This study aims to develop a more accurate and comprehensive backdoor detection method by integrating Static Code Analysis and Software Component Analysis. Feature representation is performed using Term Frequency–Inverse Document Frequency (TF-IDF), and the resulting feature vectors are used as input for several Machine Learning and Deep Learning algorithms, including Logistic Regression, K-Nearest Neighbor (KNN), Random Forest, Decision Tree, Gradient Boosting, XGBoost, LightGBM, AdaBoost, Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM). The dataset consists of 128 source code samples, comprising 60 backdoor and 68 benign samples, collected from public repositories and manually curated to ensure data quality and relevance. Experimental results demonstrate that XGBoost and KNN achieve the highest classification accuracy of 96.15%, followed by MLP, LSTM, and AdaBoost with an accuracy of 92.31%. These findings indicate that integrating static code analysis, component-based vulnerability inspection, and machine learning techniques can significantly improve the effectiveness of backdoor detection. Furthermore, the proposed approach has the potential to support automated backdoor detection within DevSecOps pipelines, thereby enhancing software security before deployment.
English
Di era transformasi digital yang pesat, perangkat lunak telah menjadi komponen penting di berbagai sektor. Namun, di lain sisi perangkat lunak juga semakin menjadi sasaran ancaman keamanan siber. Salah satu ancaman yang paling mengkhawatirkan adalah backdoor, yaitu kerentanan tersembunyi yang disisipkan secara tidak sah ke dalam perangkat lunak sehingga memungkinkan akses tanpa izin dengan menghindari mekanisme keamanan tradisional. Penelitian ini bertujuan mengembangkan metode deteksi backdoor yang lebih akurat dan komprehensif melalui integrasi Static Code Analysis dan Software Component Analysis. Representasi fitur dilakukan menggunakan Term Frequency–Inverse Document Frequency (TF-IDF), kemudian digunakan sebagai masukan bagi beberapa algoritma Machine Learning dan Deep Learning, yaitu Logistic Regression, K-Nearest Neighbor (KNN), Random Forest, Decision Tree, Gradient Boosting, XGBoost, LightGBM, AdaBoost, Multi-Layer Perceptron (MLP), dan Long Short-Term Memory (LSTM). Dataset penelitian terdiri atas 128 sampel source code, yang mencakup 60 sampel backdoor dan 68 sampel benign, dikumpulkan dari repositori publik serta dikurasi secara manual untuk menjamin kualitas dan relevansinya. Hasil eksperimen menunjukkan bahwa XGBoost dan KNN memperoleh akurasi tertinggi sebesar 96,15%, diikuti oleh MLP, LSTM, dan AdaBoost dengan akurasi 92,31%. Temuan ini menunjukkan bahwa integrasi analisis statis, inspeksi kerentanan berbasis komponen, dan teknik Machine Learning mampu meningkatkan efektivitas deteksi backdoor. Selain itu, pendekatan yang diusulkan berpotensi mendukung implementasi deteksi backdoor secara otomatis pada pipeline DevSecOps untuk meningkatkan keamanan perangkat lunak sebelum tahap deployment. Abstract In the era of rapid digital transformation, software has become a critical component across various sectors. However, it has also become an increasingly attractive target for cybersecurity threats. One of the most concerning threats is the backdoor, a hidden vulnerability that is illicitly inserted into software, enabling unauthorized access while bypassing traditional security mechanisms. This study aims to develop a more accurate and comprehensive backdoor detection method by integrating Static Code Analysis and Software Component Analysis. Feature representation is performed using Term Frequency–Inverse Document Frequency (TF-IDF), and the resulting feature vectors are used as input for several Machine Learning and Deep Learning algorithms, including Logistic Regression, K-Nearest Neighbor (KNN), Random Forest, Decision Tree, Gradient Boosting, XGBoost, LightGBM, AdaBoost, Multi-Layer Perceptron (MLP), and Long Short-Term Memory (LSTM). The dataset consists of 128 source code samples, comprising 60 backdoor and 68 benign samples, collected from public repositories and manually curated to ensure data quality and relevance. Experimental results demonstrate that XGBoost and KNN achieve the highest classification accuracy of 96.15%, followed by MLP, LSTM, and AdaBoost with an accuracy of 92.31%. These findings indicate that integrating static code analysis, component-based vulnerability inspection, and machine learning techniques can significantly improve the effectiveness of backdoor detection. Furthermore, the proposed approach has the potential to support automated backdoor detection within DevSecOps pipelines, thereby enhancing software security before deployment.
Affiliations come from OpenAlex; journal OAI-PMH metadata carries none. Authors without an OpenAlex ID are matched by name, which can merge or split people.