{"id":"https://openalex.org/W2946873049","doi":"https://doi.org/10.1109/access.2019.2919796","title":"An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis","display_name":"An Efficient Android Malware Detection System Based on Method-Level Behavioral Semantic Analysis","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2946873049","doi":"https://doi.org/10.1109/access.2019.2919796","mag":"2946873049"},"language":"en","primary_location":{"id":"doi:10.1109/access.2019.2919796","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2919796","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08725475.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08725475.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101776258","display_name":"Hanqing Zhang","orcid":"https://orcid.org/0000-0002-8715-0532"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hanqing Zhang","raw_affiliation_strings":["Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-8715-0532","affiliations":[{"raw_affiliation_string":"Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101877453","display_name":"Senlin Luo","orcid":"https://orcid.org/0000-0002-7729-5439"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Senlin Luo","raw_affiliation_strings":["Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100386936","display_name":"Yifei Zhang","orcid":"https://orcid.org/0000-0002-5177-0465"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifei Zhang","raw_affiliation_strings":["Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China","institution_ids":["https://openalex.org/I125839683"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5069772530","display_name":"Limin Pan","orcid":"https://orcid.org/0000-0002-8850-8380"},"institutions":[{"id":"https://openalex.org/I125839683","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74","country_code":"CN","type":"education","lineage":["https://openalex.org/I125839683","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Limin Pan","raw_affiliation_strings":["Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Information System and Security and Countermeasures Experiment Center, Beijing Institute of Technology, Beijing, China","institution_ids":["https://openalex.org/I125839683"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I125839683"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":7.5257,"has_fulltext":true,"cited_by_count":103,"citation_normalized_percentile":{"value":0.97973015,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":"7","issue":null,"first_page":"69246","last_page":"69256"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9886000156402588,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9800999760627747,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.879663348197937},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8663820028305054},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.7471685409545898},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.49797654151916504},{"id":"https://openalex.org/keywords/application-programming-interface","display_name":"Application programming interface","score":0.4978053569793701},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4943568706512451},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.4925437867641449},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.41829586029052734},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.4135655164718628},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.41079485416412354},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36498600244522095},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2127286195755005},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.17156103253364563},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.1683771014213562}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.879663348197937},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8663820028305054},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7471685409545898},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.49797654151916504},{"id":"https://openalex.org/C99613125","wikidata":"https://www.wikidata.org/wiki/Q165194","display_name":"Application programming interface","level":2,"score":0.4978053569793701},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4943568706512451},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.4925437867641449},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.41829586029052734},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.4135655164718628},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.41079485416412354},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36498600244522095},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2127286195755005},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.17156103253364563},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1683771014213562}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2019.2919796","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2919796","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08725475.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:ef5fe151438c40f2ae047db818086f76","is_oa":true,"landing_page_url":"https://doaj.org/article/ef5fe151438c40f2ae047db818086f76","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 7, Pp 69246-69256 (2019)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2019.2919796","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2919796","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08725475.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G8459416666","display_name":null,"funder_award_id":"2011CX01015","funder_id":"https://openalex.org/F4320323110","funder_display_name":"Beijing Institute of Technology"}],"funders":[{"id":"https://openalex.org/F4320323110","display_name":"Beijing Institute of Technology","ror":"https://ror.org/01skt4w74"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2946873049.pdf","grobid_xml":"https://content.openalex.org/works/W2946873049.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W114693439","https://openalex.org/W1943233084","https://openalex.org/W1947535385","https://openalex.org/W1990649188","https://openalex.org/W2007857904","https://openalex.org/W2024071684","https://openalex.org/W2080696000","https://openalex.org/W2122672392","https://openalex.org/W2149684865","https://openalex.org/W2155261478","https://openalex.org/W2162181963","https://openalex.org/W2324464293","https://openalex.org/W2407313496","https://openalex.org/W2575599800","https://openalex.org/W2620844046","https://openalex.org/W2744097819","https://openalex.org/W2792310543","https://openalex.org/W2891545356","https://openalex.org/W2901033482","https://openalex.org/W2909991551","https://openalex.org/W2912135847","https://openalex.org/W2963204406","https://openalex.org/W2998574808","https://openalex.org/W3014294420","https://openalex.org/W6604646702","https://openalex.org/W6682304300","https://openalex.org/W6821000344"],"related_works":["https://openalex.org/W2782775281","https://openalex.org/W2560361988","https://openalex.org/W2507113366","https://openalex.org/W1998188341","https://openalex.org/W1573526548","https://openalex.org/W4385749679","https://openalex.org/W4386500498","https://openalex.org/W2765174411","https://openalex.org/W2351528581","https://openalex.org/W4224264605"],"abstract_inverted_index":{"According":[0],"to":[1,45,74,121,148,157,168,245],"the":[2,64,91,115,134,140,159,170,223,233],"recent":[3],"report,":[4],"12":[5],"000":[6],"new":[7],"Android":[8,85,104],"malware":[9,20,86,198,205,229],"samples":[10,241],"will":[11],"be":[12],"generated":[13],"every":[14],"day.":[15],"Efficient":[16],"identification":[17],"of":[18,66,95,119,125,136,163,175,186,235],"evolving":[19,47,228],"is":[21,182],"an":[22,150],"urgent":[23],"challenge.":[24],"Traditional":[25],"methods":[26,50,111],"based":[27,51,89],"on":[28,52,90,232],"structured":[29],"features":[30],"such":[31],"as":[32],"permissions":[33],"and":[34,69,112,165,189,197,200,204,212,219,238],"sensitive":[35],"application":[36],"programming":[37],"interface":[38],"(API)":[39],"calls":[40,118,128],"lack":[41],"high-level":[42],"behavioral":[43,59,146,161],"semantics":[44,147],"detect":[46],"malware.":[48],"The":[49,173],"call":[53],"graphs":[54],"(CG)":[55],"are":[56],"good":[57],"at":[58],"semantic":[60],"analysis":[61],"but":[62],"face":[63],"problem":[65],"huge":[67],"time":[68],"space":[70],"consumption,":[71],"which":[72,144],"leads":[73],"low":[75],"detection":[76,87,171,190,214,254],"efficiency.":[77,191],"In":[78],"this":[79],"paper,":[80],"we":[81,101,132,153],"propose":[82],"a":[83,123],"novel":[84],"method":[88],"method-level":[92],"correlation":[93],"relationship":[94],"application's":[96,105],"abstracted":[97,116,126,141],"API":[98,117,127,142],"calls.":[99],"First,":[100],"split":[102],"each":[103],"source":[106],"code":[107],"into":[108],"separate":[109],"function":[110],"just":[113],"keep":[114],"them":[120],"form":[122],"set":[124],"transactions.":[129],"And":[130],"then,":[131],"calculate":[133],"confidence":[135],"association":[137],"rules":[138],"between":[139],"calls,":[143],"forms":[145],"describe":[149],"application.":[151],"Finally,":[152],"combine":[154],"machine":[155],"learning":[156],"identify":[158],"different":[160],"patterns":[162],"malicious":[164,240],"benign":[166,237],"apps":[167],"build":[169],"system.":[172],"results":[174,215],"our":[176,180,207,247],"empirical":[177],"evaluation":[178],"show":[179],"system":[181,208,225,248],"competitive":[183],"in":[184,217,226],"terms":[185],"classification":[187],"accuracy":[188,218,251],"At":[192],"dataset":[193,234],"Drebin":[194],"(benign":[195,202],"5.9K":[196],"5.6K)":[199],"AMD":[201],"20.5K":[203,239],"20.8K),":[206],"has":[209],"achieved":[210],"96%":[211],"98%":[213],"both":[216],"F-measure.":[220],"Compared":[221],"with":[222],"state-of-the-art":[224],"detecting":[227],"called":[230],"MaMaDroid":[231],"6.0K":[236],"spanning":[242],"from":[243],"2010":[244],"2017,":[246],"achieves":[249],"higher":[250],"while":[252],"improving":[253],"efficiency":[255],"by":[256],"15":[257],"times":[258],"(2.9":[259],"s":[260,263],"versus":[261],"45.7":[262],"per":[264],"sample).":[265]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":9},{"year":2024,"cited_by_count":22},{"year":2023,"cited_by_count":24},{"year":2022,"cited_by_count":15},{"year":2021,"cited_by_count":17},{"year":2020,"cited_by_count":11},{"year":2019,"cited_by_count":3}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}