{"id":"https://openalex.org/W4387886112","doi":"https://doi.org/10.1109/tdsc.2023.3325912","title":"Demystifying the Evolution of Android Malware Variants","display_name":"Demystifying the Evolution of Android Malware Variants","publication_year":2023,"publication_date":"2023-10-23","ids":{"openalex":"https://openalex.org/W4387886112","doi":"https://doi.org/10.1109/tdsc.2023.3325912"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2023.3325912","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3325912","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101974513","display_name":"Lihong Tang","orcid":"https://orcid.org/0000-0002-9525-7858"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Lihong Tang","raw_affiliation_strings":["Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0002-9525-7858","affiliations":[{"raw_affiliation_string":"Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100373723","display_name":"Xiao Chen","orcid":"https://orcid.org/0000-0002-4224-6450"},"institutions":[{"id":"https://openalex.org/I56590836","display_name":"Monash University","ror":"https://ror.org/02bfwt286","country_code":"AU","type":"education","lineage":["https://openalex.org/I56590836"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Xiao Chen","raw_affiliation_strings":["Department of Software Systems and Cybersecurity, Monash University, Clayton, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0002-4224-6450","affiliations":[{"raw_affiliation_string":"Department of Software Systems and Cybersecurity, Monash University, Clayton, VIC, Australia","institution_ids":["https://openalex.org/I56590836"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076576641","display_name":"Sheng Wen","orcid":"https://orcid.org/0000-0003-0655-666X"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Sheng Wen","raw_affiliation_strings":["Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0003-0655-666X","affiliations":[{"raw_affiliation_string":"Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5106407830","display_name":"Li Li","orcid":"https://orcid.org/0000-0003-2990-1614"},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Li Li","raw_affiliation_strings":["School of Software, Beihang University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2990-1614","affiliations":[{"raw_affiliation_string":"School of Software, Beihang University, Beijing, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058516861","display_name":"Marthie Grobler","orcid":"https://orcid.org/0000-0001-6933-0145"},"institutions":[{"id":"https://openalex.org/I4210154771","display_name":"CSIRO Manufacturing","ror":"https://ror.org/04sx9wp33","country_code":"AU","type":"facility","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4210154771","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Marthie Grobler","raw_affiliation_strings":["CSIRO's Data61, Clayton, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6933-0145","affiliations":[{"raw_affiliation_string":"CSIRO's Data61, Clayton, VIC, Australia","institution_ids":["https://openalex.org/I4210154771","https://openalex.org/I42894916"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100666554","display_name":"Yang Xiang","orcid":"https://orcid.org/0000-0001-5252-0831"},"institutions":[{"id":"https://openalex.org/I57093077","display_name":"Swinburne University of Technology","ror":"https://ror.org/031rekg67","country_code":"AU","type":"education","lineage":["https://openalex.org/I57093077"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yang Xiang","raw_affiliation_strings":["Swinburne University of Technology, Hawthorn, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0001-5252-0831","affiliations":[{"raw_affiliation_string":"Swinburne University of Technology, Hawthorn, VIC, Australia","institution_ids":["https://openalex.org/I57093077"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.7995,"has_fulltext":false,"cited_by_count":6,"citation_normalized_percentile":{"value":0.70251688,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":"21","issue":"4","first_page":"3324","last_page":"3341"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9473000168800354,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12799","display_name":"Mobile and Web Applications","score":0.9455999732017517,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7742953300476074},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7572723627090454},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.7001583576202393},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6476449966430664},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4123353362083435},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.271466463804245}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7742953300476074},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7572723627090454},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.7001583576202393},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6476449966430664},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4123353362083435},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.271466463804245}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2023.3325912","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2023.3325912","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W2560361988","https://openalex.org/W2507113366","https://openalex.org/W2591124010","https://openalex.org/W3200508744","https://openalex.org/W3025122950","https://openalex.org/W2311926078","https://openalex.org/W2895504842","https://openalex.org/W4281384336","https://openalex.org/W2717179875","https://openalex.org/W4249118297"],"abstract_inverted_index":{"It":[0],"is":[1,66],"important":[2],"to":[3,105,175],"understand":[4],"the":[5,13,70,96,114,138,142,161,164,169,172,177,213,229,234,249,287,290],"evolution":[6,48,97,149,292],"of":[7,15,75,88,130,163,171,179,228,252,262,275,289],"Android":[8,57,131,253],"malware":[9,21,47,58,76,86,148,214,254,276,309],"as":[10],"this":[11,121,267],"facilitates":[12],"development":[14],"defence":[16,305],"techniques":[17,43],"by":[18,69,113],"proactively":[19],"capturing":[20],"features.":[22],"So":[23],"far,":[24],"researchers":[25],"mainly":[26,67],"rely":[27],"on":[28,211,241,286],"dendrogram":[29],"or":[30],"family-tree":[31],"analysis":[32,74,129],"for":[33,55,145,255,295,303],"malware's":[34],"evolutionary":[35,264],"development.":[36,265],"However,":[37],"our":[38,180,186,242],"research":[39],"finds":[40],"that":[41,109,185],"these":[42,81],"cannot":[44],"support":[45],"comprehensive":[46],"modelling,":[49],"which":[50],"provides":[51],"a":[52,89,125,146,190,195,200,219,224],"detailed":[53],"explanation":[54],"why":[56],"samples":[59,87,215],"evolve":[60],"in":[61,117],"specific":[62],"ways.":[63],"This":[64],"shortcoming":[65],"caused":[68],"coarse-grained":[71],"clustering":[72,188],"and":[73,94,127,168,206,259],"samples.":[77,310],"For":[78],"example,":[79],"because":[80],"works":[82],"do":[83],"not":[84],"divide":[85],"family":[90],"into":[91],"variant":[92,143,159,165,187,230,236,257],"sets":[93,144,237],"explore":[95],"principles":[98],"among":[99,141],"those":[100],"sets,":[101],"they":[102],"usually":[103],"fail":[104],"capture":[106],"new":[107],"variants":[108],"have":[110],"been":[111],"empowered":[112],"feature":[115],"\u2018drifting\u2019":[116],"evolution.":[118,279],"To":[119],"address":[120],"problem,":[122],"we":[123,269],"propose":[124],"fine-grained":[126],"in-depth":[128],"malware.":[132],"Our":[133],"experimental":[134],"work":[135],"systematically":[136],"reveals":[137],"phylogenetic":[139],"relationships":[140],"deeper":[147],"analysis.":[150,181],"We":[151,246,280],"introduce":[152],"five":[153],"metrics:":[154],"silhouette":[155,192],"coefficient,":[156],"creation":[157],"date,":[158],"labels,":[160],"presentativeness":[162],"set":[166,231,258],"formula,":[167],"correctness":[170,178],"linked":[173,235],"edges":[174],"evaluate":[176],"The":[182],"results":[183],"show":[184],"achieved":[189],"high":[191,220,225],"value":[193],"at":[194],"small":[196,201],"sample":[197],"distance":[198],"(0.3),":[199],"standard":[202],"deviation":[203],"(three":[204],"months":[205],"16":[207],"days)":[208],"date":[209],"based":[210,240],"when":[212],"are":[216,238,301],"lastly":[217],"modified,":[218],"label":[221],"consistency":[222],"(91.4%),":[223],"representativeness":[226],"(93.1%)":[227],"formula.":[232],"All":[233],"connected":[239],"PhyloNet":[243],"construction":[244],"rules.":[245],"further":[247],"analyse":[248],"coding":[250],"details":[251],"each":[256,296],"summarise":[260],"models":[261,274,293],"their":[263],"In":[266],"work,":[268],"successfully":[270],"expose":[271],"two":[272,291],"major":[273],"evolution:active":[277],"evolutionandpassive":[278],"also":[281],"disclose":[282],"four":[283],"technical":[284],"explanations":[285],"incentives":[288],"(two":[294],"model":[297],"respectively).":[298],"These":[299],"findings":[300],"valuable":[302],"proactive":[304],"against":[306],"newly":[307],"emerged":[308]},"counts_by_year":[{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}