PENILAIAN RISIKO KEAMANAN SIBER YANG DITINGKATKAN DENGAN GENERATIVE AI (STUDI KASUS WEBSITE PERGURUAN TINGGI DI KALIMANTAN)
GENERATIVE AI-ENHANCED CYBERSECURITY RISK ASSESSMENT: A CASE STUDY OF HIGHER EDUCATION INSTITUTION WEBSITES IN KALIMANTAN
DOI:
https://doi.org/10.52972/hoaq.vol17no2.p306-317Keywords:
kecerdasan buatan generatif, penilaian risiko siber, situs web perguruan tinggi, pemodelan graf serangan, CVSS dan EPSSAbstract
Penelitian ini mengembangkan kerangka GenAI-Enhanced Cyber Risk Assessment untuk website perguruan tinggi dengan mengintegrasikan pembangkitan skenario serangan sintetis, validasi berbasis bukti, pemodelan attack graph, serta kuantifikasi risiko menggunakan CVSS, EPSS, dan centrality. Penelitian menggunakan Design Science Research dengan pendekatan mixed methods. Pipeline yang dikembangkan terdiri atas Generator Agent, Evaluator Agent, dan Reasoning Agent. Pada dataset penelitian, sebanyak 1.284 skenario unik dihasilkan setelah penyaringan format, pemeriksaan bukti, dan deduplikasi. Sebanyak 146 skenario dipilih untuk limited security validation; jumlah skenario yang memenuhi seluruh kriteria validasi empiris dilaporkan secara terpisah. Perhitungan skor risiko dilakukan secara deterministik menggunakan kombinasi CVSS normalized, EPSS, dan centrality dengan bobot 0,50, 0,30, dan 0,20. Analisis ekonomi berbasis skenario menunjukkan estimasi incremental ROI sebesar 117,5% dan benefit–cost ratio sebesar 2,18:1 pada asumsi baseline ALE Rp700.000.000, reduksi ALE 18%, dan biaya tambahan GenAI Rp57.920.000 per tahun. Nilai ekonomi tersebut merupakan estimasi sensitivitas, bukan return aktual, karena belum didasarkan pada data insiden dan biaya operasional longitudinal. Hasil penelitian menunjukkan potensi penggunaan GenAI untuk mempercepat penyusunan dan prioritisasi skenario risiko, tetapi generalisasi masih dibatasi oleh jumlah website, ketergantungan pada data sintetis, dan cakupan validasi keamanan yang terbatas.
This study develops a GenAI-Enhanced Cyber Risk Assessment framework for university websites by integrating the generation of synthetic attack scenarios, evidence-based validation, attack graph modeling, and risk quantification using CVSS, EPSS, and centrality. The study employs Design Science Research with a mixed-methods approach. The developed pipeline consists of a Generator Agent, an Evaluator Agent, and a Reasoning Agent. In the research dataset, a total of 1,284 unique scenarios were generated after format filtering, evidence checking, and deduplication. A total of 146 scenarios were selected for limited security validation; the number of scenarios meeting all empirical validation criteria is reported separately. Risk scores were calculated deterministically using a combination of normalized CVSS, EPSS, and centrality, weighted at 0.50, 0.30, and 0.20, respectively. Scenario-based economic analysis shows an estimated incremental ROI of 117.5% and a benefit–cost ratio of 2.18:1, assuming a baseline ALE of Rp700,000,000, an ALE reduction of 18%, and additional GenAI costs of Rp57,920,000 per year. These economic values are sensitivity estimates, not actual returns, as they are not yet based on longitudinal incident data and operational costs. The study results indicate the potential for using GenAI to accelerate the development and prioritization of risk scenarios; however, generalizability remains limited by the number of websites, reliance on synthetic data, and limited security validation coverage.
References
F. M. H. Tjiptabudi and R. I. Ndaumanu, “Evaluasi Celah Keamanan Website Dana Pensiun X Melalui Penetration Testing Berdasarkan ISSAF Framework,” Jurnal Algoritma, vol. 21, no. 2, pp. 9–17, Nov. 2024, doi: 10.33364/algoritma/v.21-2.1644.
N. Rani, B. Saha, and S. K. Shukla, “A Comprehensive Survey of Automated Advanced Persistent Threat Attribution: Taxonomy, Methods, Challenges and Open Research Problems,” Journal of Information Security and Applications, vol. 92, p. 104076, Jul. 2025, doi: 10.1016/j.jisa.2025.104076.
F. Fotis, “Economic Impact of Cyber Attacks and Effective Cyber Risk Management Strategies: A Light Literature Review and Case Study Analysis,” Procedia Comput. Sci., vol. 251, pp. 471–478, 2024, doi: 10.1016/j.procs.2024.11.135.
A. Tiwari, S. Singhal, and A. Srivastava, “Cybersecurity Data Science From a Machine Learning Perspective,” OPSEARCH, Oct. 2025, doi: 10.1007/s12597-025-01035-4.
R. Belen-Saglam, H. Yuan, M. S. Heering, R. Ashraf, and S. Li, “A Systematic Literature Review on Cyber Security and Privacy Risks in MaaS (Mobility-as-a-Service) Systems,” Information, vol. 16, no. 7, p. 514, Jun. 2025, doi: 10.3390/info16070514.
H. Netshiunda and S. Madzvamuse, “A Systematic Literature Review of Cybersecurity Awareness and Strategy in Rural-Based Universities,” International Journal of Applied Research in Business and Management, vol. 6, no. 5, Dec. 2025, doi: 10.51137/wrp.ijarbm.350.
S. Islam, N. Basheer, S. Papastergiou, M. Ciampi, and S. Silvestri, “Intelligent Dynamic Cybersecurity Risk Management Framework with Explainability and Interpretability of AI Models for Enhancing Security and Resilience of Digital Infrastructure,” J. Reliab. Intell. Environ., vol. 11, no. 3, p. 12, Sep. 2025, doi: 10.1007/s40860-025-00253-3.
A. Gain and M. S. Barik, “Attack Graph Based Security Metrics for Dynamic Networks,” in Information Systems Security: 19th International Conference, Raipur, India, Dec. 2023, pp. 109–128. doi: 10.1007/978-3-031-49099-6_7.
P. Balasubramanian et al., “Generative AI for Cyber Threat Intelligence: Applications, Challenges, and Analysis of Real-World Case Studies,” Artificial Intelligence Review, vol. 58, no. 11, p. 336, Aug. 2025, doi: 10.1007/s10462-025-11338-z.
H. U. Khan, R. A. Khan, H. S. Alwageed, A. O. Almagrabi, S. Ayouni, and M. Maddeh, “AI-driven Cybersecurity Framework for Software Development Based on the ANN-ISM Paradigm,” Sci. Rep., vol. 15, no. 1, p. 13423, Apr. 2025, doi: 10.1038/s41598-025-97204-y.
E. Tabassi, “Artificial Intelligence Risk Management Framework (AI RMF 1.0),” Jan. 2023. doi: 10.6028/NIST.AI.100-1.
Jack. Freund and Jack. Jones, Measuring and Managing Information Risk?: a FAIR Approach. Butterworth-Heinemann, 2025.
M. A. Ferrag et al., “Generative AI in Cybersecurity: A Comprehensive Review of LLM Applications and Vulnerabilities,” Internet of Things and Cyber-Physical Systems, vol. 5, pp. 1–46, 2025, doi: 10.1016/j.iotcps.2025.01.001.
N. O. Jaffal, M. Alkhanafseh, and D. Mohaisen, “Large Language Models in Cybersecurity: A Survey of Applications, Vulnerabilities, and Defense Techniques,” AI, vol. 6, no. 9, p. 216, Sep. 2025, doi: 10.3390/ai6090216.
M. N.-E. Saulaiman, M. Kozlovszky, and A. Csilling, “Graph-Based Automation of Threat Analysis and Risk Assessment for Automotive Security,” Information, vol. 16, no. 6, p. 449, May 2025, doi: 10.3390/info16060449.
P. Cheimonidis and K. Rantos, “A Dynamic Risk Assessment and Mitigation Model,” Applied Sciences, vol. 15, no. 4, p. 2171, Feb. 2025, doi: 10.3390/app15042171.
Y. Hassan et al., “Exploring the Mediating Role of Information Security Culture in Enhancing Sustainable Practices Through Integrated Systems Infrastructure,” Sustainability, vol. 17, no. 2, p. 687, Jan. 2025, doi: 10.3390/su17020687.
M. Alhamed and M. M. H. Rahman, “A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions,” Applied Sciences, vol. 13, no. 12, p. 6986, Jun. 2023, doi: 10.3390/app13126986.
C. Hongling et al., “Mixed Methods Research in General Practice: Key Points of Design and Implementation and Case Analysis,” Chinese General Practice Journal, vol. 2, no. 3, p. 100070, Sep. 2025, doi: 10.1016/j.cgpj.2025.100070.
J. Akoka, I. Comyn-Wattiau, N. Prat, and V. C. Storey, “Knowledge Contributions in Design Science Research: Paths of Knowledge Types,” Decision Support Systems, vol. 166, p. 113898, Mar. 2023, doi: 10.1016/j.dss.2022.113898.
L. Bracciale, S. Riozzi, G. Panico, E. Raso, G. Bianchi, and P. Loreti, “Quantifying Medical Device Cybersecurity Risk with CVSS BTE,” Scientific Reports, vol. 15, no. 1, p. 42635, Nov. 2025, doi: 10.1038/s41598-025-26898-x.
M. de F. Brilhante, D. Pestana, P. Pestana, and M. L. Rocha, “Measuring the Risk of Vulnerabilities Exploitation,” AppliedMath, vol. 4, no. 1, pp. 20–54, Dec. 2023, doi: 10.3390/appliedmath4010002.
M. Q. Li and B. C. M. Fung, “Security Concerns for Large Language Models: A survey,” Journal of Information Security and Applications, vol. 95, p. 104284, Dec. 2025, doi: 10.1016/j.jisa.2025.104284.
S. Unger, E. Arzoglou, M. Heinrich, D. Scheuermann, and S. Katzenbeisser, “Cybersecurity Risk Assessment in OT Systems Using Attack Graphs,” International Journal of Information Security, vol. 25, no. 1, p. 34, Feb. 2026, doi: 10.1007/s10207-025-01198-7.
Virginia. Braun and Victoria. Clarke, Thematic Analysis?: A Practical Guide. SAGE, 2022.
N. Y.-R. Douha, M. Sasabe, Y. Taenaka, and Y. Kadobayashi, “An Evolutionary Game Theoretic Analysis of Cybersecurity Investment Strategies for Smart-Home Users against Cyberattacks,” Applied Sciences, vol. 13, no. 7, p. 4645, Apr. 2023, doi: 10.3390/app13074645.
R. He, Z. Jin, and J. S.-H. Li, “Modeling and Management of Cyber Risk: A Cross-Disciplinary Review,” Annals of Actuarial Science, vol. 18, no. 2, pp. 270–309, Jul. 2024, doi: 10.1017/S1748499523000258.
R. Mohawesh, M. A. Ottom, and H. B. Salameh, “A Data-Driven Risk Assessment of Cybersecurity Challenges Posed by Generative AI,” Decision Analytics Journal, vol. 15, p. 100580, Jun. 2025, doi: 10.1016/j.dajour.2025.100580.
Y. Chen et al., “A survey of Large Language Models for Cyber Threat Detection,” Comput. Secur., vol. 145, p. 104016, Oct. 2024, doi: 10.1016/j.cose.2024.104016.
M. Taddeo, T. McCutcheon, and L. Floridi, “Trusting Artificial Intelligence in Cybersecurity Is a Double-Edged Sword,” 2022, pp. 289–297. doi: 10.1007/978-3-030-81907-1_15.
O. Afolalu and M. S. Tsoeu, “Cybersecurity in Higher Education Institutions: A Systematic Review of Emerging Trends, Challenges and Solutions,” Future Internet, vol. 17, no. 12, p. 575, Dec. 2025, doi: 10.3390/fi17120575.
I. H. Sarker, H. Janicke, A. Mohsin, A. Gill, and L. Maglaras, “Explainable AI for Cybersecurity Automation, Intelligence and Trustworthiness in Digital Twin: Methods, Taxonomy, Challenges and Prospects,” ICT Express, vol. 10, no. 4, pp. 935–958, Aug. 2024, doi: 10.1016/j.icte.2024.05.007.
D. Fr?szczak, “Identifying Network Propagation Sources Using Advanced Centrality Measures,” Entropy, vol. 27, no. 9, p. 948, Sep. 2025, doi: 10.3390/e27090948.
J. C. L. Ong et al., “Ethical and Regulatory Challenges of Large Language Models in Medicine,” Lancet Digit. Health, vol. 6, no. 6, pp. e428–e432, Jun. 2024, doi: 10.1016/S2589-7500(24)00061-X.
R. Bhandari, “AI and Cybersecurity: Opportunities, Challenges, and Governance,” EDPACS, pp. 1–9, Aug. 2025, doi: 10.1080/07366981.2025.2544363.
T. Hulsen, “Explainable Artificial Intelligence (XAI): Concepts and Challenges in Healthcare,” AI, vol. 4, no. 3, pp. 652–666, Aug. 2023, doi: 10.3390/ai4030034.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 HOAQ (High Education of Organization Archive Quality) : Jurnal Teknologi Informasi
This work is licensed under a Creative Commons Attribution 4.0 International License.
Jurnal HOAQ (High Education of Organization Archive Quality) : Jurnal Teknologi Informasi diterbitkan berdasarkan lisensi Creative Commons Attribution 4.0 International License (CC BY 4.0). Lisensi ini memungkinkan setiap orang untuk Berbagi: menyalin dan mendistribusikan kembali materi ini dalam format atau bentuk apapun; Adaptasi: merombak, mengubah, dan membuat turunan dari materi ini untuk keperluan apa pun, termasuk keperluan komersial, asalkan mereka memberikan pengakuan kepada Penulis Asli atas hasil karya aslinya.
