Pengujian Keamanan Aplikasi Mobile Learning Management System berbasis Deep Reinforcement Learning dengan Model Fuzzing Adaptif
DOI:
https://doi.org/10.52436/1.jpti.957Kata Kunci:
APK, Deep Reinforcement Learning, DQN, Eksplorasi UI, Fuzzing, Keamanan Aplikasi MobileAbstrak
Keamanan aplikasi Learning Management System (LMS) berbasis mobile menjadi perhatian utama seiring dengan meningkatnya penggunaan platform digital dalam kegiatan pembelajaran. Namun, pengujian keamanan secara manual dan metode fuzzing tradisional sering kali tidak efektif dalam mendeteksi kerentanan tersembunyi. Oleh karena itu, penelitian ini bertujuan untuk merancang dan mengimplementasikan model fuzzing berbasis Deep Reinforcement Learning (DRL) guna mengoptimalkan proses pengujian keamanan pada aplikasi LMS berbasis mobile dalam format APK. Model yang dikembangkan menggunakan algoritma Deep Q-Network (DQN) untuk mengeksplorasi komponen UI, intent, dan input dengan mengandalkan hasil analisis statis serta dataset payload dari OWASP dan FuzzDB. Sistem dikendalikan oleh agen DRL yang dilatih melalui interaksi bertahap dengan environment Appium dan ADB, dengan reward function yang mempertimbangkan pemicu API, deteksi crash, dan variasi aksi. Evaluasi dilakukan berdasarkan jumlah respon API yang dipicu, skenario crash yang dihasilkan, serta stabilitas dan konsistensi reward selama pelatihan. Hasil menunjukkan bahwa agen DRL mampu mempertahankan reward stabil di atas 500, memicu 11 crash unik, dan menjelajahi 95 aksi eksplorasi berbeda dengan jumlah aksi berulang yang minim. Penelitian ini menunjukkan bahwa pendekatan DRL dapat meningkatkan cakupan pengujian dan efektivitas deteksi kerentanan pada aplikasi LMS mobile. Temuan ini penting bagi pengembang dan institusi pendidikan dalam memperkuat keamanan aplikasi sebelum implementasi luas, serta berkontribusi pada pengembangan metode fuzzing otomatis berbasis kecerdasan buatan.
Unduhan
Referensi
K. Thangavel, ‘Learning Management Systems (LMS) in Higher Education: Enhancing Teaching, Learning, And Administrative Processes’, Aug. 2024, doi: 10.34293/eduspectra.v6i2.09.
C. D. Hylender, P. Langlois, A. Pinto, and S. Widup, ‘2024 Data Breach Investigations Report’, 2024. Accessed: Feb. 28, 2025. [Online]. Available: https://www.verizon.com/business/resources/Te3/reports/2024-dbir-data-breach-investigations-report.pdf
D. Greco and L. Chianese, ‘Exploiting LLMs for E-Learning: A Cybersecurity Perspective on AI-Generated Tools in Education’, in 2024 IEEE International Workshop on Technologies for Defense and Security, TechDefense 2024 - Proceedings, Institute of Electrical and Electronics Engineers Inc., 2024, pp. 237–242. doi: 10.1109/TechDefense63521.2024.10863662.
P. Hung, J. Lam, C. Wong, and T. Chan, ‘A Study on Using Learning Management System with Mobile App’, in Proceedings - 2015 International Symposium on Educational Technology, ISET 2015, Institute of Electrical and Electronics Engineers Inc., Mar. 2016, pp. 168–172. doi: 10.1109/ISET.2015.41.
H. Abdullah and S. R. M. Zeebaree, ‘Android Mobile Applications Vulnerabilities and Prevention Methods: A Review’, in Proceedings of 2021 2nd Information Technology to Enhance E-Learning and other Application Conference, IT-ELA 2021, Institute of Electrical and Electronics Engineers Inc., 2021, pp. 148–153. doi: 10.1109/IT-ELA52201.2021.9773615.
A. O. Lamina, M. F. Yussuf, T. Oyinloye, P. Oladokun, and V. K. Brown, ‘Developing a framework for enhancing security testing of android applications’, World Journal of Advanced Research and Reviews, vol. 23, no. 2, pp. 2585–2598, Aug. 2024, doi: 10.30574/wjarr.2024.23.2.2588.
X. Zhang, W. Shen, Z. Liang, L. Cui, and Y. Wang, ‘Research and Application of Automated Testing Technology for Data Security Vulnerabilities’, in 2024 4th International Conference on Mobile Networks and Wireless Communications (ICMNWC), IEEE, Dec. 2024, pp. 01–05. doi: 10.1109/ICMNWC63764.2024.10872029.
Y. Wang, Z. Wu, Q. Wei, and Q. Wang, ‘NeuFuzz: Efficient Fuzzing with Deep Neural Network’, IEEE Access, vol. 7, pp. 36340–36352, 2019, doi: 10.1109/ACCESS.2019.2903291.
M. A. Schneider, M. F. Wendland, A. Akin, and S. Senturk, ‘Fuzzing of Mobile Application in the Banking Domain: A Case Study’, in Proceedings - Companion of the 2020 IEEE 20th International Conference on Software Quality, Reliability, and Security, QRS-C 2020, Institute of Electrical and Electronics Engineers Inc., Dec. 2020, pp. 485–491. doi: 10.1109/QRS-C51114.2020.00087.
M. Foley and S. Maffeis, ‘APIRL: Deep Reinforcement Learning for REST API Fuzzing’, London, 2025. Accessed: Mar. 02, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2412.15991
F. Gao, Y. Wang, L. Situ, and L. Wang, ‘Deep Learning-Based Hybrid Fuzz Testing’, International Journal of Software and Informatics, vol. 11, no. 3, pp. 335–355, 2021, doi: 10.21655/ijsi.1673-7288.00261.
X. Liang and T. Xiao, ‘RLF: Directed Fuzzing based on Deep Reinforcement Learning’, in Proceedings - 2022 International Conference on Machine Learning, Control, and Robotics, MLCR 2022, Institute of Electrical and Electronics Engineers Inc., 2022, pp. 127–133. doi: 10.1109/MLCR57210.2022.00032.
J. Su, H. N. Dai, L. Zhao, Z. Zheng, and X. Luo, ‘Effectively Generating Vulnerable Transaction Sequences in Smart Contracts with Reinforcement Learning-guided Fuzzing’, in ACM International Conference Proceeding Series, Association for Computing Machinery, Sep. 2022. doi: 10.1145/3551349.3560429.
A. Helin, L. J. Gunn, and T. Toosi, ‘Efficient fuzzing payload generation for mobile application security testing’, Aalto University, 2024. Accessed: May 16, 2025. [Online]. Available: https://aaltodoc.aalto.fi/server/api/core/bitstreams/9791a045-6ee7-4311-9721-cf26facb267b/content
A. Romdhana, A. Merlo, M. Ceccato, and P. Tonella, ‘Deep Reinforcement Learning for Black-box Testing of Android Apps’, ACM Transactions on Software Engineering and Methodology, vol. 31, no. 4, Jul. 2022, doi: 10.1145/3502868.
K. Peffers, T. Tuunanen, M. A. Rothenberger, and S. Chatterjee, ‘A design science research methodology for information systems research’, Journal of Management Information Systems, vol. 24, no. 3, pp. 45–77, Dec. 2007, doi: 10.2753/MIS0742-1222240302.
D. Miessler, J. Haddix, and I. J. P. Portal, ‘Seclists’. Accessed: Feb. 24, 2025. [Online]. Available: https://github.com/danielmiessler/SecLists
A. Muntner, ‘FuzzDB’. Accessed: Feb. 24, 2025. [Online]. Available: https://github.com/fuzzdb-project/fuzzdb
X. Chen et al., ‘WebFuzzAuto: An Automated Fuzz Testing Tool Integrating Reinforcement Learning and Large Language Models for Web Security’, in 2024 12th International Conference on Information Systems and Computing Technology, ISCTech 2024, Institute of Electrical and Electronics Engineers Inc., 2024. doi: 10.1109/ISCTech63666.2024.10845318.
