{"id":"https://openalex.org/W7204194710","doi":"https://doi.org/10.1109/jiot.2026.3726951","title":"SACD: Robust and Interpretable Android Malware Detection in Mobile and IoT Environments","display_name":"SACD: Robust and Interpretable Android Malware Detection in Mobile and IoT Environments","publication_year":2026,"publication_date":"2026-08-25","ids":{"openalex":"https://openalex.org/W7204194710","doi":"https://doi.org/10.1109/jiot.2026.3726951"},"language":"en","primary_location":{"id":"doi:10.1109/jiot.2026.3726951","doi":"https://doi.org/10.1109/jiot.2026.3726951","is_oa":true,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3726951","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-c","cwts-core","dongbi-b","jufo-2","norway-2","poland-200","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"volume":null,"type":"article","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1109/jiot.2026.3726951","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101544517","display_name":"Deqiang Li","orcid":"https://orcid.org/0000-0003-3456-902X","observed_orcids":["https://orcid.org/0000-0003-3456-902X"]},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Deqiang Li","raw_affiliation_strings":["Nanjing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0000-0003-3456-902X","affiliations":[{"raw_affiliation_string":"Nanjing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5148136834","display_name":"Chenjian Guo","orcid":"https://orcid.org/0009-0002-1404-2095","observed_orcids":["https://orcid.org/0009-0002-1404-2095"]},"institutions":[{"id":"https://openalex.org/I41198531","display_name":"Nanjing University of Posts and Telecommunications","ror":"https://ror.org/043bpky34","country_code":"CN","type":"education","lineage":["https://openalex.org/I41198531"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chenjian Guo","raw_affiliation_strings":["Nanjing University of Posts and Telecommunications"],"raw_orcid":"https://orcid.org/0009-0002-1404-2095","affiliations":[{"raw_affiliation_string":"Nanjing University of Posts and Telecommunications","institution_ids":["https://openalex.org/I41198531"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080854999","display_name":"Pengchuan Wang","orcid":"https://orcid.org/0000-0001-8415-5103","observed_orcids":["https://orcid.org/0000-0001-8415-5103"]},"institutions":[{"id":"https://openalex.org/I39774598","display_name":"Hefei University","ror":"https://ror.org/01f5rdf64","country_code":"CN","type":"education","lineage":["https://openalex.org/I39774598"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengchuan Wang","raw_affiliation_strings":["Hefei University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hefei University","institution_ids":["https://openalex.org/I39774598"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025830771","display_name":"Aniruddha Bhattacharjya","orcid":"https://orcid.org/0000-0002-0777-7918","observed_orcids":["https://orcid.org/0000-0002-0777-7918"]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Aniruddha Bhattacharjya","raw_affiliation_strings":["Tsinghua University, Haidian"],"raw_orcid":"https://orcid.org/0000-0002-0777-7918","affiliations":[{"raw_affiliation_string":"Tsinghua University, Haidian","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081318069","display_name":"MengChu Zhou","orcid":"https://orcid.org/0000-0002-5408-8752","observed_orcids":["https://orcid.org/0000-0002-5408-8752"]},"institutions":[{"id":"https://openalex.org/I118118575","display_name":"New Jersey Institute of Technology","ror":"https://ror.org/05e74xb87","country_code":"US","type":"education","lineage":["https://openalex.org/I118118575"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mengchu Zhou","raw_affiliation_strings":["New Jersey Institute of Technology"],"raw_orcid":"https://orcid.org/0000-0002-5408-8752","affiliations":[{"raw_affiliation_string":"New Jersey Institute of Technology","institution_ids":["https://openalex.org/I118118575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111048320","display_name":"Haichao Yu","orcid":"https://orcid.org/0009-0007-6367-1193","observed_orcids":["https://orcid.org/0009-0007-6367-1193","https://orcid.org/0009-0005-0043-5455"]},"institutions":[{"id":"https://openalex.org/I4210094137","display_name":"Beijing Zhongke Science and Technology (China)","ror":"https://ror.org/00qy2fm62","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210094137"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haichao Yu","raw_affiliation_strings":["Zhongke Yungang (Beijing) Technology Company Ltd"],"raw_orcid":"https://orcid.org/0009-0005-0043-5455","affiliations":[{"raw_affiliation_string":"Zhongke Yungang (Beijing) Technology Company Ltd","institution_ids":["https://openalex.org/I4210094137"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130954971","display_name":"Fangyuan Wang","orcid":"https://orcid.org/0009-0001-5235-5626","observed_orcids":["https://orcid.org/0009-0001-5235-5626"]},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fangyuan Wang","raw_affiliation_strings":["Nanjing University of Science and Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Nanjing University of Science and Technology","institution_ids":["https://openalex.org/I36399199"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":{"value":2645,"currency":"USD","value_usd":2645},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.0,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":"22","first_page":"52494","last_page":"52507"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android-malware-detection","display_name":"Android malware detection","score":1.0},{"id":"https://openalex.org/keywords/iot-security","display_name":"Internet of Things security","score":0.8009999990463257},{"id":"https://openalex.org/keywords/concept-drift","display_name":"concept drift","score":0.8040000200271606},{"id":"https://openalex.org/keywords/structural-context","display_name":"structural context","score":0.5170000195503235},{"id":"https://openalex.org/keywords/graph-neural-networks","display_name":"graph neural networks","score":0.7850000262260437},{"id":"https://openalex.org/keywords/explainable-machine-learning","display_name":"explainable machine learning","score":0.6620000004768372},{"id":"https://openalex.org/keywords/mobile-security","display_name":"mobile security","score":0.41999998688697815}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.832099974155426},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5874999761581421},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.5361999869346619},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5196999907493591},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.4968000054359436},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.4948999881744385},{"id":"https://openalex.org/C144543869","wikidata":"https://www.wikidata.org/wiki/Q2738570","display_name":"Mobile computing","level":2,"score":0.4465999901294708},{"id":"https://openalex.org/C95491727","wikidata":"https://www.wikidata.org/wiki/Q992968","display_name":"Mobile telephony","level":3,"score":0.42179998755455017},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.40619999170303345},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3650999963283539},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35030001401901245},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3122999966144562},{"id":"https://openalex.org/C2780967490","wikidata":"https://www.wikidata.org/wiki/Q1291200","display_name":"Mobile malware","level":3,"score":0.29820001125335693},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.29109999537467957},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.28780001401901245},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28780001401901245},{"id":"https://openalex.org/C2988656282","wikidata":"https://www.wikidata.org/wiki/Q4677630","display_name":"Activity detection","level":2,"score":0.271699994802475}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2026.3726951","doi":"https://doi.org/10.1109/jiot.2026.3726951","is_oa":true,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3726951","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-c","cwts-core","dongbi-b","jufo-2","norway-2","poland-200","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1109/jiot.2026.3726951","doi":"https://doi.org/10.1109/jiot.2026.3726951","is_oa":true,"landing_page_url":"https://doi.org/10.1109/jiot.2026.3726951","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["ccf-c","cwts-core","dongbi-b","jufo-2","norway-2","poland-200","russia-white-list-1"],"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G7804090598","display_name":null,"funder_award_id":"BK20230350","funder_id":"https://openalex.org/F4320322769","funder_display_name":"Natural Science Foundation of Jiangsu Province"}],"funders":[{"id":"https://openalex.org/F4320322769","display_name":"Natural Science Foundation of Jiangsu Province","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":51,"referenced_works":["https://openalex.org/W121173099","https://openalex.org/W2010256880","https://openalex.org/W2095195675","https://openalex.org/W2122672392","https://openalex.org/W2140095007","https://openalex.org/W2168103835","https://openalex.org/W2585223762","https://openalex.org/W2601621757","https://openalex.org/W2744097819","https://openalex.org/W2791541601","https://openalex.org/W2891512841","https://openalex.org/W2961099251","https://openalex.org/W2963035797","https://openalex.org/W2964450831","https://openalex.org/W2969244304","https://openalex.org/W3000239448","https://openalex.org/W3004549544","https://openalex.org/W3021426193","https://openalex.org/W3038770761","https://openalex.org/W3097730806","https://openalex.org/W3133963303","https://openalex.org/W3177605005","https://openalex.org/W4205132420","https://openalex.org/W4205581758","https://openalex.org/W4226294137","https://openalex.org/W4244726870","https://openalex.org/W4285293538","https://openalex.org/W4288780798","https://openalex.org/W4292291386","https://openalex.org/W4294151706","https://openalex.org/W4294310652","https://openalex.org/W4312537006","https://openalex.org/W4362703128","https://openalex.org/W4376606897","https://openalex.org/W4378779717","https://openalex.org/W4389612953","https://openalex.org/W4390236359","https://openalex.org/W4390908058","https://openalex.org/W4391305442","https://openalex.org/W4392174036","https://openalex.org/W4393970627","https://openalex.org/W4403628430","https://openalex.org/W4407466172","https://openalex.org/W4408092332","https://openalex.org/W4408565907","https://openalex.org/W4408791049","https://openalex.org/W4409916767","https://openalex.org/W4411847100","https://openalex.org/W4411996801","https://openalex.org/W4411997068","https://openalex.org/W4417119306"],"related_works":["https://openalex.org/W4407844878","https://openalex.org/W2765395147","https://openalex.org/W7203469526","https://openalex.org/W7166651698","https://openalex.org/W2749405960","https://openalex.org/W4402192549","https://openalex.org/W3185163702","https://openalex.org/W2594520840","https://openalex.org/W4403782914","https://openalex.org/W7167138010"],"abstract_inverted_index":{"For":[0,108],"Android":[1,22,40,148],"malware":[2,55,170,184],"detection":[3,84,171],"in":[4],"mobile":[5],"and":[6,32,62,92,125,172,182],"Internet-of-Things":[7],"(IoT)":[8],"environments,":[9],"we":[10],"need":[11],"effective":[12],"solutions":[13],"that":[14,162],"keep":[15],"pace":[16],"with":[17,120],"the":[18,21,127,152],"evolution":[19],"of":[20,154],"ecosystem.":[23],"Existing":[24],"detectors":[25],"commonly":[26],"use":[27],"syntactic":[28],"instructions,":[29],"system":[30],"calls,":[31],"program":[33],"structures":[34],"to":[35,65,156],"capture":[36],"behavioral":[37,102],"semantics.":[38],"However,":[39],"applications":[41],"(apps)":[42],"frequently":[43],"exhibit":[44],"evolving":[45],"Application":[46],"Programming":[47],"Interfaces":[48],"(APIs),":[49],"causing":[50],"intra-class":[51],"concept":[52],"drift":[53],"within":[54],"families.":[56],"We":[57,143],"propose":[58],"SACD,":[59],"a":[60],"robust":[61],"interpretable":[63],"detector,":[64],"mitigate":[66],"such":[67],"drift.":[68],"SACD":[69,110,163],"centers":[70],"on":[71,146],"stable":[72,101,178],"features":[73],"by":[74,95],"screening":[75],"security-relevant":[76],"API":[77,106],"calls":[78],"via":[79],"expert":[80],"knowledge.":[81],"To":[82],"enhance":[83],"accuracy,":[85],"it":[86],"treats":[87],"these":[88],"APIs":[89],"as":[90],"anchors":[91],"enriches":[93],"them":[94,119],"constructing":[96],"structural":[97,112],"contexts,":[98],"thereby":[99],"providing":[100],"views":[103],"beyond":[104],"individual":[105],"occurrences.":[107],"decision-making,":[109],"encodes":[111],"contexts":[113],"using":[114],"lemmatization-based":[115],"semantic":[116],"embeddings,":[117],"processes":[118],"graph":[121],"neural":[122],"network":[123],"modules,":[124],"aggregates":[126],"resulting":[128],"graphical":[129],"representations":[130],"through":[131],"gated-attention":[132],"multiple-instance":[133],"learning.":[134],"Moreover,":[135],"learned":[136],"attention":[137],"weights":[138],"can":[139],"support":[140],"natural-language":[141],"explanations.":[142],"conduct":[144],"experiments":[145],"42,227":[147],"apps":[149],"spanning":[150],"from":[151],"year":[153],"2011":[155],"2021.":[157],"The":[158],"experimental":[159],"results":[160],"demonstrate":[161],"outperforms":[164],"representative":[165],"baselines":[166],"under":[167,179,186],"both":[168],"in-distribution":[169],"cross-year":[173],"detection.":[174],"It":[175],"also":[176],"remains":[177],"obfuscation":[180],"transformations":[181],"maintains":[183],"recall":[185],"problem-space":[187],"perturbations.":[188]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-08-26T00:00:00"}