{"id":"https://openalex.org/W7162720105","doi":null,"title":"Context Is Key: Combining Static Analysis and AI for Actionable Android App Analysis","display_name":"Context Is Key: Combining Static Analysis and AI for Actionable Android App Analysis","publication_year":2026,"publication_date":"2026-05-22","ids":{"openalex":"https://openalex.org/W7162720105"},"language":"en","primary_location":{"id":"pmh:oai:orbilu.uni.lu:10993/68466","doi":null,"is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/68466","pdf_url":"https://orbilu.uni.lu/bitstream/10993/68466/1/Phd_Thesis_MarcoAlecci.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"http://purl.org/coar/resource_type/c_db06"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://orbilu.uni.lu/bitstream/10993/68466/1/Phd_Thesis_MarcoAlecci.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040342077","display_name":"Marco Alecci","orcid":"https://orcid.org/0000-0002-5963-4599","observed_orcids":["https://orcid.org/0000-0002-5963-4599"]},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]},{"id":"https://openalex.org/I4405259781","display_name":"Interdisciplinary Centre for Security, Reliability and Trust","ror":"https://ror.org/02qav7c04","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577","https://openalex.org/I4405259781"]}],"countries":["LU"],"is_corresponding":true,"raw_author_name":"ALECCI, Marco","raw_affiliation_strings":["University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > TruX"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > TruX","institution_ids":["https://openalex.org/I186903577","https://openalex.org/I4405259781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5040342077"],"corresponding_institution_ids":["https://openalex.org/I186903577","https://openalex.org/I4405259781"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9940999746322632,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0032999999821186066,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0003000000142492354,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android-application-security","display_name":"Android application security","score":0.8939999938011169},{"id":"https://openalex.org/keywords/static-analysis","display_name":"static analysis","score":0.8539999723434448},{"id":"https://openalex.org/keywords/logic-bombs","display_name":"logic bombs","score":0.7350000143051147},{"id":"https://openalex.org/keywords/data-flow-analysis","display_name":"data flow analysis","score":0.5550000071525574},{"id":"https://openalex.org/keywords/false-alarm-reduction","display_name":"false alarm reduction","score":0.6809999942779541}],"concepts":[{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.8675000071525574},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7698000073432922},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6958000063896179},{"id":"https://openalex.org/C2988045736","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android app","level":3,"score":0.5073000192642212},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.4307999908924103},{"id":"https://openalex.org/C2776836400","wikidata":"https://www.wikidata.org/wiki/Q31087","display_name":"Calculator","level":2,"score":0.42879998683929443},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.3926999866962433},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3822000026702881},{"id":"https://openalex.org/C2988145974","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Mobile apps","level":2,"score":0.364300012588501},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.3508000075817108},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3481000065803528},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.3450999855995178},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.32710000872612},{"id":"https://openalex.org/C175801342","wikidata":"https://www.wikidata.org/wiki/Q1988917","display_name":"Data analysis","level":2,"score":0.32339999079704285},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.314300000667572},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.30320000648498535},{"id":"https://openalex.org/C98183937","wikidata":"https://www.wikidata.org/wiki/Q2112188","display_name":"Program analysis","level":2,"score":0.29580000042915344},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.28679999709129333},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.27810001373291016},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.26159998774528503},{"id":"https://openalex.org/C2989277270","wikidata":"https://www.wikidata.org/wiki/Q168338","display_name":"Behavioral analysis","level":2,"score":0.26010000705718994},{"id":"https://openalex.org/C3017619522","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Smartphone app","level":2,"score":0.2540999948978424},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.25279998779296875},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:orbilu.uni.lu:10993/68466","doi":null,"is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/68466","pdf_url":"https://orbilu.uni.lu/bitstream/10993/68466/1/Phd_Thesis_MarcoAlecci.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"http://purl.org/coar/resource_type/c_db06"}],"best_oa_location":{"id":"pmh:oai:orbilu.uni.lu:10993/68466","doi":null,"is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/68466","pdf_url":"https://orbilu.uni.lu/bitstream/10993/68466/1/Phd_Thesis_MarcoAlecci.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"http://purl.org/coar/resource_type/c_db06"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7162720105.pdf","grobid_xml":"https://content.openalex.org/works/W7162720105.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W1532142362","https://openalex.org/W2080696000","https://openalex.org/W2096196901","https://openalex.org/W2158874007","https://openalex.org/W2165232124","https://openalex.org/W2407313496","https://openalex.org/W2548152313","https://openalex.org/W2620787348","https://openalex.org/W2795143051","https://openalex.org/W2890190663","https://openalex.org/W2913090618","https://openalex.org/W3211399334","https://openalex.org/W4244726870","https://openalex.org/W4308632289","https://openalex.org/W4391558373","https://openalex.org/W4395474395","https://openalex.org/W4399115016","https://openalex.org/W4411997068","https://openalex.org/W4414281281","https://openalex.org/W4414939355","https://openalex.org/W6947991961"],"related_works":["https://openalex.org/W2596096409","https://openalex.org/W6998540357","https://openalex.org/W2343325785","https://openalex.org/W2339678038","https://openalex.org/W6945857413","https://openalex.org/W7214853646","https://openalex.org/W2902043491","https://openalex.org/W4379522603","https://openalex.org/W2070192880","https://openalex.org/W7099812130"],"abstract_inverted_index":{"Android":[0,245,261,438],"apps":[1,307],"are":[2,77,122,278],"a":[3,11,29,54,175,196,310],"central":[4,55],"part":[5,179],"of":[6,14,87,107,119,153,174,180,244,292,304,320,357,418],"our":[7],"lives;":[8],"they":[9,79],"support":[10],"wide":[12],"range":[13],"activities":[15],"such":[16,91,217,273],"as":[17,274],"communication,":[18],"navigation,":[19],"finance,":[20],"health,":[21],"and":[22,36,63,66,158,184,203,215,242,308,346,368,448,460,468],"more.":[23],"Apps":[24],"handle":[25],"sensitive":[26,350],"data":[27,171,193,351,394,401,405],"on":[28,45,99,343,365,399,421],"daily":[30],"basis;":[31],"therefore,":[32],"ensuring":[33],"their":[34,134],"security":[35,42,65,467],"privacy":[37,67,469],"is":[38,143,178,226,251],"paramount.":[39],"Today,":[40],"app":[41,177,198,246,262,358,439,443],"heavily":[43],"relies":[44],"automated":[46],"analysis":[47,75,130,146,328,380,423,440,456],"tools.":[48],"Among":[49],"these,":[50],"static":[51,74,108,145,212,247,455],"analyzers":[52,213],"play":[53],"role":[56],"in":[57,195,471],"identifying":[58],"suspicious":[59,202],"behaviors,":[60],"potential":[61],"vulnerabilities,":[62],"other":[64],"risks":[68,470],"at":[69],"scale.":[70],"In":[71,228,256,322,374],"practice,":[72],"when":[73],"tools":[76,147,361],"used,":[78],"often":[80,279],"overwhelm":[81],"practitioners":[82,391,463],"with":[83,150],"drastically":[84],"large":[85],"volumes":[86],"results.":[88],"Inspecting":[89],"all":[90,411],"outputs":[92,457],"not":[93],"only":[94],"increases":[95],"the":[96,104,128,154,159,188,191,240,290,300,317,363,366,370,379,422],"cognitive":[97],"burden":[98,364],"analysts":[100],"but":[101],"also":[102,426],"reduces":[103],"practical":[105,214],"utility":[106],"analysis,":[109],"making":[110],"it":[111],"difficult":[112],"to":[113,127,282,336,397,464],"extract":[114],"actionable":[115],"insights.":[116],"Additionally,":[117],"many":[118],"these":[120,236,360],"results":[121,371,419],"false":[123,428],"alarms":[124],"or":[125],"irrelevant":[126],"specific":[129,400],"task,":[131],"which":[132,264,314,341,348],"limits":[133],"concrete":[135],"actionability.":[136],"One":[137],"main":[138],"reason":[139],"for":[140,393],"this":[141,229,435],"limitation":[142],"that":[144,168,234,389],"typically":[148],"operate":[149],"limited":[151],"awareness":[152],"app\u2019s":[155,268],"intended":[156],"functionality":[157],"analyst\u2019s":[160],"objective.":[161],"As":[162],"an":[163,208,267,386],"example,":[164],"one":[165],"may":[166,199],"consider":[167],"some":[169],"location":[170,404],"flowing":[172],"out":[173],"navigation":[176],"its":[181],"normal":[182],"operation":[183],"expected":[185,269,318],"behavior.":[186],"At":[187],"same":[189,192],"time,":[190],"flow":[194,450],"calculator":[197],"be":[200,205,220],"highly":[201],"should":[204],"prioritized":[206],"by":[207,238,431,441],"analyst.":[209],"To":[210,295],"make":[211,369,454],"effective,":[216],"information":[218],"must":[219],"taken":[221],"into":[222,253],"account.":[223],"Hence,":[224],"context":[225,381],"key.":[227],"manuscript,":[230],"we":[231,259,298,325,377,384],"present":[232],"contributions":[233,453],"address":[235,296],"challenges":[237],"improving":[239],"actionability":[241],"relevance":[243],"analysis.":[248,294,451],"This":[249,414],"work":[250],"organized":[252],"three":[254],"parts.":[255],"Part":[257,323,375],"I,":[258],"revisit":[260],"categorization,":[263,444],"directly":[265],"affects":[266],"functionality.":[270],"Existing":[271],"categorizations,":[272],"Google":[275],"Play":[276],"categories,":[277],"too":[280],"broad":[281],"capture":[283],"meaningful":[284],"behavioral":[285],"differences":[286],"between":[287],"apps,":[288],"limiting":[289],"effectiveness":[291],"context-aware":[293,445],"this,":[297],"construct":[299],"first":[301],"ground-truth":[302],"dataset":[303],"fine-grained":[305],"categorized":[306],"propose":[309,385],"new":[311],"categorization":[312],"approach,":[313],"better":[315],"reflects":[316],"behavior":[319],"applications.":[321],"II,":[324],"introduce":[326],"two":[327],"approaches":[329],"leveraging":[330],"multiple":[331],"category-specific":[332],"anomaly":[333,446],"detection":[334,396],"models":[335],"identify":[337,466],"unusual":[338],"behaviors:":[339],"Difuzer++,":[340],"focuses":[342],"logic":[344],"bombs,":[345],"DamFlow,":[347],"targets":[349],"leaks.":[352],"By":[353],"integrating":[354],"contextual":[355],"understanding":[356],"behavior,":[359],"reduce":[362],"analyst":[367],"more":[372,458],"actionable.":[373],"III,":[376],"explore":[378],"itself.":[382],"Specifically,":[383],"LLM-based":[387],"approach":[388,415],"allows":[390,416],"aiming":[392],"leak":[395],"focus":[398],"flows":[402],"(e.g.,":[403],"sent":[406],"via":[407],"SMS)":[408],"rather":[409],"than":[410],"possible":[412],"flows.":[413],"prioritization":[417],"based":[420],"objective":[424],"while":[425],"reducing":[427],"negatives":[429],"introduced":[430],"existing":[432],"approaches.":[433],"Altogether,":[434],"manuscript":[436],"advances":[437],"combining":[442],"detection,":[447],"task-specific":[449],"The":[452],"relevant":[459],"actionable,":[461],"empowering":[462],"efficiently":[465],"real-world":[472],"apps.":[473]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-05-29T00:00:00"}