{"id":"https://openalex.org/W4417131678","doi":"https://doi.org/10.1109/jiot.2025.3641836","title":"A Lightweight Android Malware Detection Framework Based on Markov Images and Knowledge Distillation","display_name":"A Lightweight Android Malware Detection Framework Based on Markov Images and Knowledge Distillation","publication_year":2025,"publication_date":"2025-12-08","ids":{"openalex":"https://openalex.org/W4417131678","doi":"https://doi.org/10.1109/jiot.2025.3641836"},"language":null,"primary_location":{"id":"doi:10.1109/jiot.2025.3641836","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3641836","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5064524859","display_name":"Liangwei Yao","orcid":"https://orcid.org/0009-0007-2944-4632"},"institutions":[{"id":"https://openalex.org/I4210159676","display_name":"Zaozhuang University","ror":"https://ror.org/05x21tp94","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210159676"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liangwei Yao","raw_affiliation_strings":["School of Information Science and Engineering, Zaozhuang University, Zaozhuang, China"],"raw_orcid":"https://orcid.org/0009-0007-2944-4632","affiliations":[{"raw_affiliation_string":"School of Information Science and Engineering, Zaozhuang University, Zaozhuang, China","institution_ids":["https://openalex.org/I4210159676"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089827558","display_name":"Yang Xin","orcid":"https://orcid.org/0000-0002-9706-3950"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Xin","raw_affiliation_strings":["School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-9706-3950","affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Minghui Liu","orcid":"https://orcid.org/0009-0003-9636-7586"},"institutions":[{"id":"https://openalex.org/I4210130112","display_name":"China Academy of Information and Communications Technology","ror":"https://ror.org/038dte259","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210130112","https://openalex.org/I890469752"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Minghui Liu","raw_affiliation_strings":["China Academy of Information and Communications Technology, Security Research Institute, Beijing, China","Security Research Institute of China Academy of Information and Communications Technology, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0003-9636-7586","affiliations":[{"raw_affiliation_string":"China Academy of Information and Communications Technology, Security Research Institute, Beijing, China","institution_ids":["https://openalex.org/I4210130112"]},{"raw_affiliation_string":"Security Research Institute of China Academy of Information and Communications Technology, Beijing, China","institution_ids":["https://openalex.org/I4210130112"]}]},{"author_position":"last","author":{"id":null,"display_name":"Qian Zhang","orcid":"https://orcid.org/0009-0009-3746-6115"},"institutions":[{"id":"https://openalex.org/I4210159676","display_name":"Zaozhuang University","ror":"https://ror.org/05x21tp94","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210159676"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qian Zhang","raw_affiliation_strings":["School of Mechanical and Electrical Engineering, Zaozhuang University, Zaozhuang, China"],"raw_orcid":"https://orcid.org/0009-0009-3746-6115","affiliations":[{"raw_affiliation_string":"School of Mechanical and Electrical Engineering, Zaozhuang University, Zaozhuang, China","institution_ids":["https://openalex.org/I4210159676"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":1.1071,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.80105585,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"13","issue":"3","first_page":"5224","last_page":"5241"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9921000003814697,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9921000003814697,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0005000000237487257,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/opcode","display_name":"Opcode","score":0.8751000165939331},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5863000154495239},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.498199999332428},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4426000118255615},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.44110000133514404},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.4325999915599823},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.420199990272522},{"id":"https://openalex.org/keywords/mobile-computing","display_name":"Mobile computing","score":0.35370001196861267}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8885999917984009},{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.8751000165939331},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5863000154495239},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.498199999332428},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4426000118255615},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.44110000133514404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.435699999332428},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.4325999915599823},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.43160000443458557},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.420199990272522},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.40799999237060547},{"id":"https://openalex.org/C144543869","wikidata":"https://www.wikidata.org/wiki/Q2738570","display_name":"Mobile computing","level":2,"score":0.35370001196861267},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.3107999861240387},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.3068999946117401},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2989000082015991},{"id":"https://openalex.org/C23224414","wikidata":"https://www.wikidata.org/wiki/Q176769","display_name":"Hidden Markov model","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.27709999680519104},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.27709999680519104},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2766000032424927},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.2727999985218048},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C2778814252","wikidata":"https://www.wikidata.org/wiki/Q5156715","display_name":"Composability","level":2,"score":0.2599000036716461}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2025.3641836","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3641836","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G138956789","display_name":null,"funder_award_id":"0747-2361SCCZA204","funder_id":"https://openalex.org/F4320335960","funder_display_name":"National Major Science and Technology Projects of China"},{"id":"https://openalex.org/G8035212347","display_name":null,"funder_award_id":"62233003","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335960","display_name":"National Major Science and Technology Projects of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W2122672392","https://openalex.org/W2194775991","https://openalex.org/W2549139847","https://openalex.org/W2752782242","https://openalex.org/W2768073432","https://openalex.org/W2792310543","https://openalex.org/W2883780447","https://openalex.org/W2885070483","https://openalex.org/W2906631928","https://openalex.org/W2922509574","https://openalex.org/W2928165649","https://openalex.org/W2943383044","https://openalex.org/W2963163009","https://openalex.org/W2963446712","https://openalex.org/W2982083293","https://openalex.org/W2982705228","https://openalex.org/W2982739679","https://openalex.org/W2986232939","https://openalex.org/W2992853260","https://openalex.org/W3000239448","https://openalex.org/W3004549544","https://openalex.org/W3007065235","https://openalex.org/W3007553983","https://openalex.org/W3011624874","https://openalex.org/W3023107948","https://openalex.org/W3030531411","https://openalex.org/W3034429256","https://openalex.org/W3034552520","https://openalex.org/W3038275207","https://openalex.org/W3083703328","https://openalex.org/W3097192014","https://openalex.org/W3105429705","https://openalex.org/W3147879240","https://openalex.org/W3161742098","https://openalex.org/W3177052299","https://openalex.org/W3201749075","https://openalex.org/W3203801049","https://openalex.org/W3210231570","https://openalex.org/W4207065299","https://openalex.org/W4289752563","https://openalex.org/W4293521695","https://openalex.org/W4312847199","https://openalex.org/W4367595786","https://openalex.org/W4381233012","https://openalex.org/W4385755457","https://openalex.org/W4386852161","https://openalex.org/W4388019121","https://openalex.org/W4390562648","https://openalex.org/W4391886995","https://openalex.org/W4392858381","https://openalex.org/W4394670654","https://openalex.org/W4396506213","https://openalex.org/W4400192394","https://openalex.org/W4402186292","https://openalex.org/W4408800844","https://openalex.org/W4415534669"],"related_works":[],"abstract_inverted_index":{"The":[0,91,184,213],"Android":[1,87],"system":[2,35],"has":[3,23,227],"been":[4],"widely":[5],"used":[6],"in":[7],"mobile":[8,234],"devices":[9,66],"and":[10,17,29,36,54,67,105,133,179,196,204,223,226,235],"embedded":[11,134],"terminals,":[12],"significantly":[13,208],"enhancing":[14],"user":[15],"interaction":[16],"service":[18],"efficiency.":[19],"However,":[20],"its":[21,166],"openness":[22],"also":[24],"led":[25],"to":[26,61,139,155],"increasingly":[27],"frequent":[28],"evolving":[30],"malware":[31,88],"attacks,":[32],"seriously":[33],"threatening":[34],"data":[37],"security.":[38],"Existing":[39],"detection":[40,89,220],"methods":[41],"generally":[42],"suffer":[43],"from":[44],"problems":[45],"such":[46],"as":[47],"large":[48],"model":[49,158,206],"size,":[50,207],"high":[51,55],"computational":[52,202],"overhead,":[53],"deployment":[56,224],"costs,":[57],"making":[58],"it":[59],"difficult":[60],"run":[62],"efficiently":[63],"on":[64,98,110,172,233],"resource-constrained":[65],"have":[68],"limited":[69],"generalization":[70,167],"ability":[71],"for":[72,230],"new":[73],"or":[74],"unknown":[75],"malware.":[76],"To":[77],"this":[78,80],"end,":[79],"paper":[81],"proposes":[82],"a":[83,124,136,149,161,216],"high-precision,":[84],"low-overhead,":[85],"lightweight":[86,125,137],"framework.":[90],"framework":[92,190,214],"first":[93],"performs":[94],"fine-grained":[95],"static":[96],"analysis":[97],"APK":[99],"files,":[100],"extracts":[101],"Dalvik":[102],"opcode":[103],"sequences,":[104],"generates":[106],"grayscale":[107],"images":[108],"based":[109],"Markov":[111],"transition":[112],"probabilities,":[113],"thereby":[114],"transforming":[115],"program":[116],"behavior":[117],"patterns":[118],"into":[119,135],"learnable":[120],"visual":[121],"representations.":[122],"Secondly,":[123],"adaptive":[126],"channel":[127],"attention":[128],"(ACA)":[129],"mechanism":[130],"is":[131,153],"designed":[132],"CNN":[138],"enhance":[140],"the":[141,173,180,188],"model\u2019s":[142],"perception":[143],"of":[144,193],"crucial":[145],"feature":[146],"channels.":[147],"Finally,":[148],"knowledge":[150],"distillation":[151],"strategy":[152],"introduced":[154],"guide":[156],"student":[157],"training":[159],"using":[160],"high-performance":[162],"teacher":[163],"model,":[164],"improving":[165],"ability.":[168],"Experiments":[169],"are":[170],"conducted":[171],"publicly":[174],"available":[175],"datasets":[176],"CICMalDroid2020,":[177],"CICAndMal2017,":[178],"newly":[181],"constructed":[182],"dataset.":[183],"results":[185],"show":[186],"that":[187],"proposed":[189],"achieves":[191,215],"accuracy":[192],"98.50%,":[194],"98.63%,":[195],"81.16%,":[197],"respectively,":[198],"while":[199],"maintaining":[200],"low":[201],"overhead":[203],"small":[205],"outperforming":[209],"existing":[210],"advanced":[211],"methods.":[212],"good":[217],"balance":[218],"between":[219],"accuracy,":[221],"efficiency,":[222],"feasibility,":[225],"strong":[228],"potential":[229],"widespread":[231],"application":[232],"IoT":[236],"devices.":[237]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-12-08T00:00:00"}