{"id":"https://openalex.org/W4408281749","doi":"https://doi.org/10.1109/tifs.2025.3550049","title":"DeepVMUnProtect: Neural Network-Based Recovery of VM-Protected Android Apps for Semantics-Aware Malware Detection","display_name":"DeepVMUnProtect: Neural Network-Based Recovery of VM-Protected Android Apps for Semantics-Aware Malware Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4408281749","doi":"https://doi.org/10.1109/tifs.2025.3550049"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3550049","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3550049","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102208696","display_name":"Zhao Xin","orcid":"https://orcid.org/0009-0004-9336-1880"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Zhao","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0004-9336-1880","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100695047","display_name":"Mu Zhang","orcid":"https://orcid.org/0000-0001-5905-9515"},"institutions":[{"id":"https://openalex.org/I223532165","display_name":"University of Utah","ror":"https://ror.org/03r0ha626","country_code":"US","type":"education","lineage":["https://openalex.org/I223532165"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mu Zhang","raw_affiliation_strings":["Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA","University of Utah, Salt Lake City, UT, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA","institution_ids":["https://openalex.org/I223532165"]},{"raw_affiliation_string":"University of Utah, Salt Lake City, UT, USA","institution_ids":["https://openalex.org/I223532165"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073700416","display_name":"Xiaopeng Ke","orcid":"https://orcid.org/0009-0006-0039-4013"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaopeng Ke","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0006-0039-4013","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yu Pan","orcid":"https://orcid.org/0009-0000-1031-0385"},"institutions":[{"id":"https://openalex.org/I223532165","display_name":"University of Utah","ror":"https://ror.org/03r0ha626","country_code":"US","type":"education","lineage":["https://openalex.org/I223532165"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yu Pan","raw_affiliation_strings":["Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA","University of Utah, Salt Lake City, UT, USA"],"raw_orcid":"https://orcid.org/0009-0000-1031-0385","affiliations":[{"raw_affiliation_string":"Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA","institution_ids":["https://openalex.org/I223532165"]},{"raw_affiliation_string":"University of Utah, Salt Lake City, UT, USA","institution_ids":["https://openalex.org/I223532165"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059590465","display_name":"Yue Duan","orcid":null},"institutions":[{"id":"https://openalex.org/I79891267","display_name":"Singapore Management University","ror":"https://ror.org/050qmg959","country_code":"SG","type":"education","lineage":["https://openalex.org/I79891267"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yue Duan","raw_affiliation_strings":["School of Computing and Information Systems, Singapore Management University, Bras Basah, Singapore","Singapore Management University, 81 Victoria St, Singapore"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computing and Information Systems, Singapore Management University, Bras Basah, Singapore","institution_ids":["https://openalex.org/I79891267"]},{"raw_affiliation_string":"Singapore Management University, 81 Victoria St, Singapore","institution_ids":["https://openalex.org/I79891267"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060268538","display_name":"Sheng Zhong","orcid":"https://orcid.org/0000-0002-6581-8730"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sheng Zhong","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-6581-8730","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5114549816","display_name":"Fengyuan Xu","orcid":"https://orcid.org/0000-0003-3388-7544"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyuan Xu","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-3388-7544","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8858,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.83625235,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"20","issue":null,"first_page":"3689","last_page":"3704"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9878000020980835,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9505000114440918,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8402043581008911},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8130906224250793},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.7595479488372803},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.6261085271835327},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6006061434745789},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.49762728810310364},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.4334315061569214},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.32887160778045654},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.26682883501052856},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.1748114824295044}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8402043581008911},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8130906224250793},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.7595479488372803},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.6261085271835327},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6006061434745789},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.49762728810310364},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.4334315061569214},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.32887160778045654},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.26682883501052856},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.1748114824295044}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3550049","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3550049","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1028567220","display_name":null,"funder_award_id":"62272224","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2166296455","display_name":null,"funder_award_id":"62302207","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2379088649","display_name":null,"funder_award_id":"62272215","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2711646438","display_name":null,"funder_award_id":"000748","funder_id":"https://openalex.org/F4320320671","funder_display_name":"National Research Foundation"},{"id":"https://openalex.org/G2767175847","display_name":null,"funder_award_id":"2022YFF0604503","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G2984182209","display_name":null,"funder_award_id":"OAC-2115167","funder_id":"https://openalex.org/F4320332169","funder_display_name":"Directorate for Computer and Information Science and Engineering"},{"id":"https://openalex.org/G3184683627","display_name":null,"funder_award_id":"62432004","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4285073634","display_name":null,"funder_award_id":"62341201","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7250526562","display_name":null,"funder_award_id":"HR00112120009","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"}],"funders":[{"id":"https://openalex.org/F4320307791","display_name":"Cisco Systems","ror":"https://ror.org/03yt1ez60"},{"id":"https://openalex.org/F4320320671","display_name":"National Research Foundation","ror":"https://ror.org/05s0g1g46"},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320332169","display_name":"Directorate for Computer and Information Science and Engineering","ror":"https://ror.org/025kzpk63"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W1538186256","https://openalex.org/W1578479379","https://openalex.org/W1975966552","https://openalex.org/W2049629426","https://openalex.org/W2128389850","https://openalex.org/W2131523719","https://openalex.org/W2153393809","https://openalex.org/W2168103835","https://openalex.org/W2264131323","https://openalex.org/W2296128045","https://openalex.org/W2599823825","https://openalex.org/W2603160474","https://openalex.org/W2617476279","https://openalex.org/W2783327762","https://openalex.org/W2792393499","https://openalex.org/W2801888526","https://openalex.org/W2885070483","https://openalex.org/W2906631928","https://openalex.org/W3004280948","https://openalex.org/W3016369654","https://openalex.org/W3048726132","https://openalex.org/W3105429705","https://openalex.org/W3153386443","https://openalex.org/W3180919983","https://openalex.org/W3210231570","https://openalex.org/W6604743090","https://openalex.org/W6628233427","https://openalex.org/W6636510571","https://openalex.org/W6722579827","https://openalex.org/W6732855312","https://openalex.org/W6743691393","https://openalex.org/W6743716703","https://openalex.org/W6766561868","https://openalex.org/W6810837584"],"related_works":["https://openalex.org/W2560361988","https://openalex.org/W2507113366","https://openalex.org/W2591124010","https://openalex.org/W3200508744","https://openalex.org/W3025122950","https://openalex.org/W2311926078","https://openalex.org/W2895504842","https://openalex.org/W1565885216","https://openalex.org/W2717179875","https://openalex.org/W4249118297"],"abstract_inverted_index":{"The":[0,11],"emerging":[1],"virtual":[2],"machine-based":[3],"Android":[4,62],"packers":[5],"render":[6],"existing":[7],"unpacking":[8],"techniques":[9],"ineffective.":[10],"state-of-the-art":[12,70],"unpacker":[13],"falls":[14],"short":[15],"because":[16],"it":[17,28],"relies":[18],"on":[19,72],"unreliable":[20],"heuristics":[21],"and":[22,49,79,83],"manually":[23],"crafted":[24],"semantic":[25],"models.":[26],"Hence,":[27],"cannot":[29],"precisely":[30],"recover":[31],"app":[32],"semantics":[33,53,75],"necessary":[34],"for":[35],"malware":[36,63,87],"detection.":[37],"In":[38],"this":[39],"paper,":[40],"we":[41],"proposeDeepVMUnProtect,":[42],"a":[43],"deep":[44],"learning-based":[45],"approach":[46],"to":[47,59,93],"automatically":[48],"accurately":[50],"capture":[51],"the":[52,69],"of":[54],"VM-packed":[55],"code,":[56],"so":[57],"as":[58],"facilitate":[60],"semantic-based":[61],"classification.":[64],"Experiments":[65],"have":[66],"shown":[67],"thatDeepVMUnProtectoutperforms":[68],"tool":[71],"recovering":[73],"opcode":[74],"in":[76],"Qihoo(58.3%),":[77],"Baidu(47.5%)":[78],"NMMP":[80],"(58.8%)":[81],"respectively,":[82],"can":[84],"enable":[85],"semantics-aware":[86],"detection":[88],"which":[89],"prior":[90],"work":[91],"fails":[92],"do.":[94]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-03-11T00:00:00"}