{"id":"https://openalex.org/W4401633919","doi":"https://doi.org/10.1109/tdsc.2024.3444913","title":"GNNDroid: Graph-Learning Based Malware Detection for Android Apps With Native Code","display_name":"GNNDroid: Graph-Learning Based Malware Detection for Android Apps With Native Code","publication_year":2024,"publication_date":"2024-08-16","ids":{"openalex":"https://openalex.org/W4401633919","doi":"https://doi.org/10.1109/tdsc.2024.3444913"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2024.3444913","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3444913","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042663855","display_name":"Ning Xi","orcid":"https://orcid.org/0000-0003-0690-5321"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ning Xi","raw_affiliation_strings":["School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","School of Cyber Engineering, Xidian University, Xi&#x0027;an, China"],"raw_orcid":"https://orcid.org/0000-0003-0690-5321","affiliations":[{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yuchen Zhang","orcid":"https://orcid.org/0009-0002-2768-8565"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuchen Zhang","raw_affiliation_strings":["School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","School of Cyber Engineering, Xidian University, Xi&#x0027;an, China"],"raw_orcid":"https://orcid.org/0009-0002-2768-8565","affiliations":[{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101785225","display_name":"Pengbin Feng","orcid":"https://orcid.org/0009-0001-8207-1472"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengbin Feng","raw_affiliation_strings":["School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","School of Cyber Engineering, Xidian University, Xi&#x0027;an, China"],"raw_orcid":"https://orcid.org/0009-0001-8207-1472","affiliations":[{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016972157","display_name":"Siqi Ma","orcid":"https://orcid.org/0000-0003-3479-5713"},"institutions":[{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Siqi Ma","raw_affiliation_strings":["School of Systems and Computing, University of New South Wales, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0003-3479-5713","affiliations":[{"raw_affiliation_string":"School of Systems and Computing, University of New South Wales, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I31746571"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5012016098","display_name":"Jianfeng Ma","orcid":"https://orcid.org/0000-0003-4251-1143"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianfeng Ma","raw_affiliation_strings":["School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","School of Cyber Engineering, Xidian University, Xi&#x0027;an, China"],"raw_orcid":"https://orcid.org/0000-0003-4251-1143","affiliations":[{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043356063","display_name":"Yulong Shen","orcid":"https://orcid.org/0000-0002-8448-705X"},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yulong Shen","raw_affiliation_strings":["School of Computer Science and Technology, Xidian University, Xi&#x2019;an, China","School of Computer Science and Technology, Xidian University, Xi&#x0027;an, China"],"raw_orcid":"https://orcid.org/0000-0002-8448-705X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Computer Science and Technology, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103864761","display_name":"Yale Yang","orcid":null},"institutions":[{"id":"https://openalex.org/I149594827","display_name":"Xidian University","ror":"https://ror.org/05s92vm98","country_code":"CN","type":"education","lineage":["https://openalex.org/I149594827"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yale Yang","raw_affiliation_strings":["School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","School of Cyber Engineering, Xidian University, Xi&#x0027;an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x2019;an, China","institution_ids":["https://openalex.org/I149594827"]},{"raw_affiliation_string":"School of Cyber Engineering, Xidian University, Xi&#x0027;an, China","institution_ids":["https://openalex.org/I149594827"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.8446,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.71105082,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"22","issue":"2","first_page":"1460","last_page":"1476"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12799","display_name":"Mobile and Web Applications","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12016","display_name":"Web Data Mining and Analysis","score":0.951200008392334,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8548109531402588},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.825721263885498},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.7318812608718872},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6473023891448975},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4173990488052368},{"id":"https://openalex.org/keywords/call-graph","display_name":"Call graph","score":0.4108927249908447},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3693830370903015},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.35279297828674316},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3470280170440674},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.2299569845199585}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8548109531402588},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.825721263885498},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.7318812608718872},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6473023891448975},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4173990488052368},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.4108927249908447},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3693830370903015},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35279297828674316},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3470280170440674},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2299569845199585}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2024.3444913","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2024.3444913","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2495480902","display_name":null,"funder_award_id":"92167203","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4328264082","display_name":null,"funder_award_id":"92267204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6030431395","display_name":null,"funder_award_id":"62232013","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W1987375341","https://openalex.org/W2060692877","https://openalex.org/W2080696000","https://openalex.org/W2122672392","https://openalex.org/W2573983983","https://openalex.org/W2577540292","https://openalex.org/W2599654449","https://openalex.org/W2782578820","https://openalex.org/W2782999659","https://openalex.org/W2794801050","https://openalex.org/W2849849680","https://openalex.org/W2885030880","https://openalex.org/W2885070483","https://openalex.org/W2885072546","https://openalex.org/W2890190663","https://openalex.org/W2890664869","https://openalex.org/W2897812226","https://openalex.org/W2941199301","https://openalex.org/W2964136807","https://openalex.org/W2969244304","https://openalex.org/W2969904462","https://openalex.org/W2978480967","https://openalex.org/W3005144047","https://openalex.org/W3009677746","https://openalex.org/W3023107948","https://openalex.org/W3036561203","https://openalex.org/W3046317287","https://openalex.org/W3097730806","https://openalex.org/W3105429705","https://openalex.org/W3134204681","https://openalex.org/W3147879240","https://openalex.org/W3216588331","https://openalex.org/W4210345192","https://openalex.org/W4221153183","https://openalex.org/W4226294137","https://openalex.org/W4284693098","https://openalex.org/W4285059789","https://openalex.org/W4293521695","https://openalex.org/W4308641639","https://openalex.org/W4313216189","https://openalex.org/W4387298149","https://openalex.org/W4388483517","https://openalex.org/W4392412743","https://openalex.org/W4392697189","https://openalex.org/W6690815549","https://openalex.org/W6713582119","https://openalex.org/W6743915909","https://openalex.org/W6754733780","https://openalex.org/W6758684365","https://openalex.org/W6761664358"],"related_works":["https://openalex.org/W2782775281","https://openalex.org/W2560361988","https://openalex.org/W2507113366","https://openalex.org/W2591124010","https://openalex.org/W3200508744","https://openalex.org/W4311848503","https://openalex.org/W3025122950","https://openalex.org/W2895504842","https://openalex.org/W2717179875","https://openalex.org/W4249118297"],"abstract_inverted_index":{"With":[0],"the":[1,22,29,64,79,83,88,102,130,170,180,193,207],"rapid":[2],"development":[3],"of":[4,13,24,38,97,256,274],"mobile":[5],"apps,":[6],"developers":[7],"tend":[8],"to":[9,15,27,67,86,125,149,168,179,191,205],"implement":[10],"a":[11,40,116,163,199],"variety":[12],"functionalities":[14,31],"support":[16],"users\u2019":[17],"demands.":[18],"Thus,":[19],"they":[20],"involve":[21],"usage":[23],"native":[25,65,94,108,137,147,156,176,251],"libraries":[26],"fulfill":[28],"luxuriant":[30],"and":[32,107,136,146,155,175,209,223,250],"maintain":[33],"fast":[34],"system":[35],"responses,":[36],"instead":[37],"using":[39],"unitary":[41],"programming":[42,50],"language":[43],"(i.e.,":[44,244,265],"Java).":[45],"Nonetheless,":[46],"such":[47],"an":[48,254,272],"inter-language":[49],"framework":[51],"also":[52,259],"introduces":[53],"more":[54],"security":[55,70],"issues":[56],"because":[57],"attackers":[58],"can":[59],"conceal":[60],"malicious":[61,90,211],"behaviors":[62,91,104,131],"at":[63],"level":[66],"evade":[68],"Android":[69,221],"vetting.":[71],"Existing":[72],"state-of-the-art":[73,227],"detection":[74,120],"tools":[75],"mainly":[76],"rely":[77],"on":[78],"information":[80],"extracted":[81],"in":[82,93,105,111,133],"Java":[84,106,135,145,151,173,249,262,269],"code":[85,148,174,181],"infer":[87],"potential":[89],"implemented":[92,132,246,267],"code.":[95,109,138,177],"None":[96],"them":[98,225],"could":[99],"simultaneously":[100],"study":[101],"correlated":[103],"Therefore,":[110],"this":[112],"paper,":[113],"we":[114],"proposed":[115],"static":[117],"semantic-driven":[118],"malware":[119,127],"tool,":[121],"<sc":[122,140,183,215,233],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[123,141,184,216,234],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">GNNDroid</small>,":[124],"distinguish":[126,210],"by":[128,218,247,268],"combining":[129],"both":[134,248],"First,":[139],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">GNNDroid</small>":[142,185,217,235],"separately":[143],"analyzes":[144],"construct":[150],"function":[152,157,165],"call":[153,158],"graphs":[154],"graphs.":[159],"It":[160],"then":[161],"utilizes":[162],"regex-based":[164],"recognition":[166],"approach":[167],"explore":[169],"correlations":[171],"between":[172],"According":[178],"correlations,":[182],"constructs":[186],"Multi-Relational":[187],"Directed":[188],"Graphs":[189],"(MRDGs)":[190],"extract":[192],"comprehensive":[194],"behaviors.":[195],"Finally,":[196],"it":[197],"executes":[198],"Gated":[200],"Graph":[201],"Neural":[202],"Network":[203],"(GGNN)":[204],"analyze":[206],"MRDGs":[208],"apps.":[212],"We":[213],"assessed":[214],"analyzing":[219,241],"40,000":[220],"apps":[222,243,245,264,266],"compared":[224],"with":[226],"tools.":[228],"The":[229],"result":[230],"demonstrated":[231],"that":[232],"not":[236],"only":[237,263],"performs":[238],"well":[239],"when":[240],"Java+native":[242],"code),":[252,270],"achieving":[253,271],"F1":[255,273],"98.57%":[257],"but":[258],"effectively":[260],"exploits":[261],"96.31%.":[275]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}