hermawan setiawan

Scopus Publications

Benchmarking DevSecOps Pipelines: A Performance and Security Analysis of Laravel and CodeIgniter
Muhammad Faki Raihan, Hermawan Setiawan
Proceedings 2025 IEEE 2nd International Conference on Cryptography Informatics and Cybersecurity Icocics 2025, 2025
This study presents a comparative analysis of the performance and implementation of DevSecOps pipelines in two popular PHP frameworks, Laravel and CodeIgniter. To provide empirical data, two functionally identical web applications were developed and tested within a CI/CD pipeline orchestrated by Jenkins. The pipeline integrated SonarQube for Static Application Security Testing (SAST) and OWASP ZAP for Dynamic Application Security Testing (DAST) to automate security evaluations. The primary research goals were to measure pipeline execution time, compare resource consumption (CPU and memory), and analyze the detection effectiveness of the security tools on both frameworks. The results show that CodeIgniter is more efficient (execution time of 152 seconds vs. 167 seconds). However, both automated SAST and DAST tools failed to detect critical vulnerabilities without deep configuration, emphasizing the trade-off between efficiency and implementation effort. The main contribution of this study is empirical evidence demonstrating how a framework's architecture directly influences the trade-off between pipeline efficiency and the implementation effort required for meaningful security analysis, underscoring that automated tools are a baseline that requires intelligent human configuration to be truly effective.
Evaluation of Web Security and Performance in PHP Frameworks: A Case Study of Codeigniter 4 and Yii2
M. Dja’far Karzein Hafidz Yuntanozra, Hermawan Setiawan, I Komang Setia Buana
Proceedings 2025 IEEE 2nd International Conference on Cryptography Informatics and Cybersecurity Icocics 2025, 2025
The selection of a framework is critical in web application development, especially for e-commerce systems that require both performance efficiency and strong data protection. This study compares two widely used PHP frameworks, CodeIgniter 4 and Yii2, by developing two identical e-commerce prototypes to ensure fair evaluation. Security testing was conducted using Dynamic Application Security Testing (DAST) tools, including OWASP ZAP and Wapiti3, to detect common vulnerabilities such as Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). Performance testing was conducted using Apache Benchmark (ab), with a focus on requests per second (RPS), response time, and transfer rate. The results show that CodeIgniter 4 reported higher proportions of CSRF (19%) and XSS (59%) vulnerabilities compared to Yii2 with only 0.6 % and 1 %, respectively. Conversely, Yii2 showed more weaknesses in security header configurations, including the absence of Content Security Policy (24 %) and missing anti-clickjacking headers <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$(12 \%)$</tex>. In terms of performance, Yii2 achieved on average 12.9 % higher RPS and 11.6 % faster response times, while CodeIgniter 4 exhibited a transfer rate nearly 2.2 times greater. These findings highlight a trade-off between security and performance in framework selection. Yii2 is more suitable for applications that prioritize stronger default security, whereas CodeIgniter 4 is advantageous for systems that require higher data throughput.
Extended Self-Adaptive Honey Encryption (XSHE) for User Authentication Scheme Using a Generative Adversarial Network (GAN)
Adek Muhammad Zulkham RK, Girinoto, Herman Kabetta, Hermawan Setiawan
Proceedings 2025 IEEE 2nd International Conference on Cryptography Informatics and Cybersecurity Icocics 2025, 2025
Robust user authentication is essential for safeguarding privacy and restricting system access to authorized personnel. Although password-based authentication remains a standard and cost-effective method, it continues to be vulnerable to malicious attacks. Existing enhancements, such as honey encryption and honeywords, seek to complicate password guessing; however, they still possess vulnerabilities related to genuine passwords. To overcome these limitations, this study proposes Extended Self-Adaptive Honey Encryption (XSHE), an innovative user authentication methodology. XSHE utilizes the PassGAN model to generate highly realistic synthetic passwords, further enhancing adaptability and real-time threat response, thus reducing dependence on actual user passwords and alleviating risks associated with conventional attacks. We have implemented and evaluated XSHE within a Python-based password authentication system. The results demonstrate that the seamless integration of PassGAN on the login interface significantly enhances the security of the password database and improves the detection of password-cracking attempts, thereby contributing to a more resilient authentication framework.
Beyond Static Analysis: Detecting SQL Injection via Context-Aware Code Review in Web Applications
Christopher Ralin Anggoman, Rakha Maulana, Hermawan Setiawan, Muhammad Aqil Nuur Al-Farabi
Proceedings 2025 IEEE 2nd International Conference on Cryptography Informatics and Cybersecurity Icocics 2025, 2025
Static analysis tools are widely integrated into modern software development pipelines to assist in detecting security vulnerabilities. However, these tools often fall short when addressing context-sensitive issues such as SQL Injection (SQLi), particularly in applications with dynamic query construction and complex data flows. This study introduces a structured, context-aware manual code review methodology designed to identify SQLi vulnerabilities commonly missed by static analyzers. The process includes input tracing, propagation analysis, verification of sanitization mechanisms, and control flow assessment. The proposed approach was applied to a widely used open-source library management system deployed in educational institutions in Indonesia. Four critical SQLi vulnerabilities were identified, successfully validated using time-based blind SQLi techniques with SQLMap, and formally registered under the CVE program. Neither DeepSource nor SonarCloud, under default configurations, detected any of these flaws, yielding a detection coverage of 0 percent. Beyond reporting these vulnerabilities, the study provides a new insight: manual context-aware review can detect context-sensitive SQLi that are consistently missed by automated tools. This finding underscores the indispensable role of human-in-the-loop auditing in uncovering real-world vulnerabilities and highlights the limitations of relying solely on automated static analysis in secure software development lifecycles.
Optimization of MLP-Regressor for Predicting Student's Cumulative Grade Point Average (GPA)
Hermawan Setiawan, Ihsan Fadli Tampati, I Gede Maha Putra, Girinoto
Icsintesa 2024 2024 4th International Conference of Science and Information Technology in Smart Administration the Collaboration of Smart Technology and Good Governance for Sustainable Development Goals, 2024
In the digital age, vast amounts of data offer opportunities to enhance student outcomes and achieve sustainable educational goals. Educational institutions aim to identify factors influencing academic performance and predict exam scores to provide tailored support to students in need. Educational Data Mining (EDM) techniques enable in-depth analysis of students’ historical data. Prior research has identified factors such as learning methods, study environment, parental involvement, and pressure as significant influencers of academic achievement. This study takes a novel approach by training a deep learning model on historical cumulative GPA data from Politeknik Siber dan Sandi Negara using regression to accurately predict cumulative GPA. The model is implemented in a web application, alerting educators to students at risk of declining cumulative GPA. The Multi-layer Perceptron (MLP) regressor is employed for training and evaluation, yielding optimized configurations for the number of neurons, hidden layer depth, and Adam optimizer with constant learning rate. Evaluation results using MSE, RMSE, MAE, R-squared, and Breusch-Pagan Test show that the model has good performance. Future research could focus on expanding the dataset to achieve greater predictive accuracy thereby empowering institutions to offer targeted support to students in need.
Implementation of Game-Based Learning to Enhance Security Awareness Against Child Cyber Grooming Attacks
Fikra Amalia Raihana, Hermawan Setiawan, Herman Kabetta, Nurul Qomariasih
2024 8th International Conference on Information Technology Information Systems and Electrical Engineering Icitisee 2024, 2024
Online Gender-Based Violence (OGBV) has become an urgent concern with the rising cases of OGBV, especially during the Covid-19 pandemic. One alarming form of OGBV is cyber grooming, particularly child cyber grooming, which often targets children who lack adequate knowledge about safe internet use. Education is a crucial key in combating child cyber grooming crimes. This research aims to design a game-based learning application as an educational medium to enhance children's understanding of child cyber grooming crimes through the application of the Digital Game-Based Learning Instructional Design (DGBL-ID) method. DGBL-ID is chosen because its development stages focus not only on game design but also on instructional design. The application will be tailored to the needs of young children, making it expected to effectively convey concepts according to their needs and understanding. The application will be tested using the User Acceptance Test (UAT) approach to ensure its usability as an educational medium. The effectiveness of the application in enhancing early childhood knowledge will be measured using the One-Group Pre-test Post-test method and analyzed with the Wilcoxon Test. The research results show that the use of educational game applications in this study can make a significant contribution to increasing children's understanding of child cyber grooming crimes. Educational game media is an interesting and beneficial learning tool for children to understand the risks and necessary preventive actions for safe internet use.
Code Obfuscation in CI/CD Pipelines for Enhanced DevOps Security
Angelita Salsabila Afifah, Herman Kabetta, I Komang Setia Buana, Hermawan Setiawan
2024 International Conference on Artificial Intelligence Blockchain Cloud Computing and Data Analytics Icoabcd 2024, 2024
In recent years, DevOps (Development and Operations) has become an essential part of the software industry, offering practices that enable quick, reliable, and high-quality software delivery. The business world's increasing demand for speed and expertise has highlighted the need for DevOps methods that streamline development stages without compromising software quality. Concurrently, security breaches such as data leaks necessitate addressing security threats in software, especially in the DevOps process. It has led to integrating security into DevOps, termed DevSecOps, which enhances software quality by embedding security principles. CI/CD, a DevOps practice, involves continuous integration, delivery, and code deployment. Continuous Deployment ensures software stability through automated testing before server deployment. The main goal of this research is to overcome source code hijacking attempts while in the CI/CD pipeline; even if it happens, the source code will not be easy to read and prevent the possibility of being modified by unauthorized users; technical protection via obfuscation is essential. This research proposes using the Blowfish encryption algorithm for code obfuscation in the CI/CD pipeline. Blowfish is preferred due to its shorter encryptionldecryption times. This automated code obfuscation mechanism, implemented in the CI/CD pipeline using GitHub Actions, aims to develop secure systems by making the source code more difficult to understand, ensuring secure Continuous Deployment.
A Design for Comprehensive Information System Management Framework Integrating Secure Software Development, Resource Management, and Real-Time Monitoring
Herlambang Rafli Wicaksono, Ihsan Fadli Tampati, Nathanael Berliano Novanka Putra, Hermawan Setiawan, Dimas Rifqi Firmansyah
Proceedings International Conference on Informatics and Computational Sciences, 2024
This paper proposes a holistic framework for the development, management, and monitoring of secure web information systems. Emphasizing a secure software development life cycle (SDLC), resource management, and real-time monitoring, the framework aims to standardize and enhance the process of web application development while prioritizing security at every phase. The framework incorporates threat modeling during planning and design, security guidelines during implementation, and continuous vulnerability scanning. Additionally, it integrates resource management to ensure effective allocation of human, hardware, and software resources. Tools are employed for real-time monitoring, providing usage insights that inform managerial decisions. The proposed framework strives to create a comprehensive approach to web application development that is both secure and well-managed. The implementation results demonstrate the proposed framework’s effectiveness in simplifying development, optimizing resources, and enhancing security for web applications. Furthermore, compared to the secure software development lifecycle (SSDLC) framework, it offers advantages in resource management and real-time monitoring, rendering it more comprehensive.
SocengGo: Social Engineering Educational Application Based on Attack-Defense Multiplayer Card Game
Fadel Azzahra, Nurul Qomariasih, Herman Kabetta, Hermawan Setiawan, Rheva Anindya Wijayanti, Taqiya Nabilla Nathania Afnani
Proceedings International Conference on Education and Technology ICET, 2024
Social engineering is still considered one of the most threatening attacks in the digital world. One of the best defenses against social engineering starts with education. Since it is important to present education in an engaging way, this research proposes an educational application with an attack-defense card game concept for social engineering education, namely SocengGo. The application applies the multiplayer concept to address the collaborative learning challenge in Education 4.0. The card game flow adopts the Cangkulan and UNO card games. The cards in the game consist of attack elements that describe social engineering techniques, defense elements that describe preventive measures for certain social engineering techniques, and the value of the effectiveness of defense elements against attack elements. The application can be accepted by users with the User Acceptance Index criteria of reaching ‘very acceptable’ and receiving a ‘positive’ response from application users, especially on the multiplayer concept which is promoted with value. This application has also been proven to be able to increase understanding of social engineering techniques and preventive steps.
Enhancing Data Governance and Personal Data Protection: A Strategic Review for Cases in Indonesia
Raden Budiarto, I Komang Setia Buana, Herman Kabetta, Hermawan Setiawan, Girinoto, Nurul Qomariasih
Proceedings 6th International Conference on Informatics Multimedia Cyber and Information System Icimcis 2024, 2024
This paper examines the state of data governance in developed countries and its application in Indonesia. The study explores the mechanisms used by developed countries, including comprehensive data protection laws, independent regulatory authorities, and established data governance frameworks. It also discusses how data-sharing initiatives drive innovation, economic growth, and enhanced data utilization in these countries. In Indonesia, data governance regulations are outlined in the Personal Data Protection (PDP) law and government regulations on system operators and electronic transactions. The paper presents the results of a PESTLE analysis, which indicates favorable political, economic, social, technological, environmental, and legal factors for data governance in Indonesia. However, challenges such as weak data sovereignty, lack of public awareness, and incomplete regulations must be addressed. A SWOT analysis highlights strengths, such as a growing digital economy and government commitment to privacy and data protection, and weaknesses, such as the absence of a personal data protection commission and incomplete regulations. This paper concludes with recommendations for the Indonesian government and society to strengthen data sovereignty, establish a dedicated regulatory body, enhance public awareness, develop comprehensive data governance frameworks, foster collaboration, and improve data security measures. Implementing these recommendations will enable Indonesia to establish a robust data governance ecosystem that protects individual privacy, attracts foreign investment, and drives the growth of the digital economy.
Designing and Building a Web-based Electronic Service Manuscript Application by Making Comparisons of AES and Blowfish Algorithms for Securing Data in the Database
Pandu Bagus Diancaraka, Hermawan Setiawan, Syafira Mardhiyah
Aip Conference Proceedings, 2023
Text Preprocessing for Optimal Accuracy in Indonesian Sentiment Analysis Using a Deep Learning Model with Word Embedding
Raden Budiarto Hadiprakoso, Hermawan Setiawan, Ray Novita Yasa, Girinoto
Aip Conference Proceedings, 2023
Secure Mobile Application for Uniform Resource Locator (URL) Phising Detection based on Deep Learning
Ihsan Fadli Tampati, I Komang Setia Buana, Hermawan Setiawan
2023 1st International Conference on Advanced Engineering and Technologies Iconnic 2023 Proceeding, 2023
SIGNIN: The Digital Signature and File Verification Management Application Using Secure Rapid Application Development Approach
Nathanael Berliano Novanka Putra, Girinoto Girinoto, Hermawan Setiawan, Arizal Arizal
Proceeding International Conference on Information Technology and Computing 2023 Icitcom 2023, 2023
Benchmarking Model URL Features and Image Based for Phishing URL Detection
Olga Geby Nabila, Herlambang Rafli Wicaksono, Girinoto, Ray Novita Yasa, Hermawan Setiawan
2023 International Conference on Informatics Multimedia Cyber and Information Systems Icimcis 2023, 2023
Anti-Phishing Game Framework Based on Extended Design Play Experience (DPE) Framework as an Educational Media
Dikka Aditya Satria Wibawa, Hermawan Setiawan, Girinoto
Iwbis 2022 7th International Workshop on Big Data and Information Security Proceedings, 2022
Analysis of Centralized vs Decentralized Electronic Voting
Zidna Wildan Alfain, Hermawan Setiawan, I Komang Setia Buana
Proceeding IEEE 8th Information Technology International Seminar Itis 2022, 2022
Development of Final Year Project System (FIPOS) Based on Website with One-Time Password
Muhammad Irfan Cahyanto, Raden Budiarto Hadiprakoso, Hermawan Setiawan, Nadia Paramita
Proceeding IEEE 8th Information Technology International Seminar Itis 2022, 2022
Analysis of SQL Injection Attack Detection and Prevention on MySQL Database Using Input Categorization and Input Verifier
Alya Aiman Salsabila Arif, Rahmat Purwoko, Nurul Qomariasih, Hermawan Setiawan
Proceeding IEEE 8th Information Technology International Seminar Itis 2022, 2022
Attendance System Using Two Factor Authentication Based on Secure App with Flutter
Donny Irwansyah, I Komang Setia Buana, Hermawan Setiawan, Andriani Adi Lestari
Proceeding IEEE 8th Information Technology International Seminar Itis 2022, 2022
Design and Development of Information Sharing and Analysis Center (ISAC) as an Information Sharing Platform
Intan Maratus Sholihah, Hermawan Setiawan, Olga Geby Nabila
2021 6th International Conference on Informatics and Computing Icic 2021, 2021
Design and Development Hands-On Vulnerable Web Application as a Software Security Educational Media
Riama Kristallia, Hermawan Setiawan, Siti Manayra Sabiya
2021 6th International Conference on Informatics and Computing Icic 2021, 2021
Modified RNP Privacy Protection Data Mining Method as Big Data Security
Ray Novita Yasa, I Komang Setia Buana, Girinoto, Hermawan Setiawan, Raden Budiarto Hadiprakoso
Proceedings 3rd International Conference on Informatics Multimedia Cyber and Information System Icimcis 2021, 2021
Implementation of lashkari et al scheme and convergent encryption on cloud-based secure deduplication application
Hermawan Setiawan, Rico Setyawan
Iop Conference Series Materials Science and Engineering, 2020
Classification of Personality Type Based on Twitter Data Using Machine Learning Techniques
Hermawan Setiawan, Achmad Abdul Wafi
2020 3rd International Conference on Information and Communications Technology Icoiact 2020, 2020
Vulnerability Analysis Using the Interactive Application Security Testing (IAST) Approach for Government X Website Applications
Hermawan Setiawan, Lytio Enggar Erlangga, Ido Baskoro
2020 3rd International Conference on Information and Communications Technology Icoiact 2020, 2020
Face Anti-Spoofing Using CNN Classifier Face liveness Detection
Raden Budiarto Hadiprakoso, Hermawan Setiawan, Girinoto
2020 3rd International Conference on Information and Communications Technology Icoiact 2020, 2020
Comparison of LSTM Architecture for Malware Classification
Girinoto, Hermawan Setiawan, Prasetyo Adi Wibowo Putro, Yogha Restu Pramadi
Proceedings 2nd International Conference on Informatics Multimedia Cyber and Information System Icimcis 2020, 2020
Implementation of Multi-Entry Onscreen Keyboard Model on Android-Based Mobile Application to Prevent Shoulder Surfing Attack
Hermawan Setiawan, Rafif Masrur Rauf
Proceeding 1st International Conference on Information Technology Advanced Mechanical and Electrical Engineering Icitamee 2020, 2020
Designing and building secure electronic medical record application by applying AES-256 and RSA digital signature
Galih Wening Werdi Mukti, Hermawan Setiawan
Iop Conference Series Materials Science and Engineering, 2020
Implementation the Mutual Authentication with Key Agreement Scheme for Securing Web-Based E- prescribing System
Dwi Jayanti, Hermawan Setiawan
Proceedings of 2019 4th International Conference on Informatics and Computing Icic 2019, 2019
Implementation of Signcryption Scheme on E-Payment System (ePaSe)
Ari Andriansah, Hermawan Setiawan
Proceedings 1st International Conference on Informatics Multimedia Cyber and Information System Icimcis 2019, 2019
Implementation of SHA-256 and AES-256 for Securing Digital Al Quran Verification System
Anggraeni Shinta Dewi, Hermawan Setiawan
Proceedings of 2019 4th International Conference on Informatics and Computing Icic 2019, 2019
Correlation between Motivation and Achievement of Competencies in the Hands-On Learning Method
Prasetyo Adi Wibowo Putro, Yoga Restu Pramadi, Hermawan Setiawan, Nur Kholis Gunawan, Raden Budiarto Hadiprakoso, Herman Kabetta
2019 5th International Conference on Education and Technology ICET 2019, 2019
Design of secure electronic disposition applications by applying blowfish, SHA-512, and RSA digital signature algorithms to government institution
Hermawan Setiawan, Kesuma Rey Citra
2018 International Seminar on Research of Information Technology and Intelligent Systems Isriti 2018, 2018
Design of information security risk management using ISO/IEC 27005 and NIST SP 800-30 revision 1: A case study at communication data applications of XYZ institute
Hermawan Setiawan, Fandi Aditya Putra, Anggi Rifa Pradana
2017 International Conference on Information Technology Systems and Innovation Icitsi 2017 Proceedings, 2017

hermawan setiawan

RESEARCH, TEACHING, or OTHER INTERESTS

Scopus Publications

RECENT SCHOLAR PUBLICATIONS

MOST CITED SCHOLAR PUBLICATIONS