{"id":"https://openalex.org/W4412795931","doi":"https://doi.org/10.1109/tifs.2025.3594559","title":"BPFDex: Enabling Robust Android Apps Unpacking via Android Kernel","display_name":"BPFDex: Enabling Robust Android Apps Unpacking via Android Kernel","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4412795931","doi":"https://doi.org/10.1109/tifs.2025.3594559"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3594559","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3594559","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5044775088","display_name":"Mingyang Li","orcid":"https://orcid.org/0009-0008-4604-1787"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingyang Li","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"],"raw_orcid":"https://orcid.org/0009-0008-4604-1787","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029715489","display_name":"Weina Niu","orcid":"https://orcid.org/0000-0002-3235-3463"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weina Niu","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"],"raw_orcid":"https://orcid.org/0000-0002-3235-3463","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jiacheng Gong","orcid":"https://orcid.org/0009-0000-7970-9968"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiacheng Gong","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"],"raw_orcid":"https://orcid.org/0009-0000-7970-9968","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100448208","display_name":"Song Li","orcid":"https://orcid.org/0000-0002-7961-8502"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Song Li","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-7961-8502","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102892645","display_name":"Mingxue Zhang","orcid":"https://orcid.org/0000-0001-8863-8751"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mingxue Zhang","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-8863-8751","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":null,"display_name":"Xiaosong Zhang","orcid":"https://orcid.org/0000-0001-8673-9284"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaosong Zhang","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"],"raw_orcid":"https://orcid.org/0000-0001-8673-9284","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China","institution_ids":["https://openalex.org/I150229711"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.9024,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.74350246,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"20","issue":null,"first_page":"8083","last_page":"8095"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9944000244140625,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9771999716758728,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/unpacking","display_name":"Unpacking","score":0.8701852560043335},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8086315989494324},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.7717119455337524},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.4323175549507141}],"concepts":[{"id":"https://openalex.org/C2777256151","wikidata":"https://www.wikidata.org/wiki/Q7897273","display_name":"Unpacking","level":2,"score":0.8701852560043335},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8086315989494324},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.7717119455337524},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4323175549507141},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3594559","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3594559","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","score":0.44999998807907104,"display_name":"Decent work and economic growth"}],"awards":[{"id":"https://openalex.org/G3706400858","display_name":null,"funder_award_id":"2024NSFTD0031","funder_id":"https://openalex.org/F4320336756","funder_display_name":"Tianjin Science and Technology Program"},{"id":"https://openalex.org/G6027530306","display_name":null,"funder_award_id":"62372086","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7879776620","display_name":null,"funder_award_id":"2025ZNSFSC0500","funder_id":"https://openalex.org/F4320329861","funder_display_name":"Natural Science Foundation of Sichuan Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320329861","display_name":"Natural Science Foundation of Sichuan Province","ror":null},{"id":"https://openalex.org/F4320336756","display_name":"Tianjin Science and Technology Program","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W1964545511","https://openalex.org/W1988036170","https://openalex.org/W1998341327","https://openalex.org/W2002083372","https://openalex.org/W2007857904","https://openalex.org/W2015790908","https://openalex.org/W2057726290","https://openalex.org/W2066596410","https://openalex.org/W2264131323","https://openalex.org/W2343325785","https://openalex.org/W2488579949","https://openalex.org/W2575599800","https://openalex.org/W2792393499","https://openalex.org/W2793030797","https://openalex.org/W2897585077","https://openalex.org/W2963856074","https://openalex.org/W3011196476","https://openalex.org/W3027862040","https://openalex.org/W3133041728","https://openalex.org/W3153386443","https://openalex.org/W3166973211","https://openalex.org/W3180919983","https://openalex.org/W3192824891","https://openalex.org/W4239799938","https://openalex.org/W4244726870","https://openalex.org/W4285490441","https://openalex.org/W6640059210","https://openalex.org/W6712192629","https://openalex.org/W6712398639","https://openalex.org/W6712460733","https://openalex.org/W6744280195","https://openalex.org/W6796070040"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2980032325","https://openalex.org/W2042188247","https://openalex.org/W2017714611","https://openalex.org/W4224995949","https://openalex.org/W1992482086","https://openalex.org/W2385797406","https://openalex.org/W1565885216"],"abstract_inverted_index":{"Malware":[0],"developers":[1],"exploit":[2],"packing":[3,98,103],"techniques":[4],"to":[5,59,96,101,117,158],"protect":[6],"malicious":[7],"apps":[8,82,133,151],"from":[9,92],"analysis.":[10],"These":[11],"evolving":[12],"techniques,":[13],"coupled":[14],"with":[15],"diverse":[16],"anti-unpacker":[17,110,147],"strategies,":[18],"often":[19],"render":[20],"current":[21],"studies":[22],"ineffective":[23],"in":[24,109,156],"unpacking":[25,37,78,120],"Android":[26,36,47,60,113],"apps.":[27],"In":[28],"this":[29],"study,":[30],"we":[31,106],"introduce":[32],"BPFDex,":[33],"a":[34,42],"novel":[35],"framework":[38],"that":[39,143,161],"leverages":[40],"eBPF,":[41],"kernel":[43,54,71,87],"component":[44],"of":[45,76],"the":[46,70],"system.":[48],"We":[49,122],"successfully":[50,145],"apply":[51],"eBPF\u2019s":[52],"excellent":[53],"observability":[55],"and":[56,66,86,94,149],"tracing":[57],"capability":[58],"unpacking,":[61],"both":[62,84],"on":[63,126],"real":[64],"devices":[65],"emulators.":[67],"Operating":[68],"within":[69],"space,":[72],"BPFDex":[73,80,127,144],"avoids":[74],"drawbacks":[75],"common":[77],"techniques.":[79],"monitors":[81],"across":[83],"native":[85],"layers,":[88],"restores":[89],"Dex":[90],"data":[91],"memory,":[93],"adapts":[95],"different":[97,138],"strategies":[99,148],"according":[100],"observed":[102],"behaviors.":[104],"Furthermore,":[105],"summarize":[107],"patterns":[108],"behaviors":[111],"among":[112],"packers,":[114,155],"establishing":[115],"criteria":[116],"improve":[118],"existing":[119],"strategies.":[121],"conduct":[123],"extensive":[124],"experiments":[125],"by":[128,135,153],"leveraging":[129],"more":[130],"than":[131],"3k":[132],"packed":[134,152],"over":[136],"eight":[137],"packers.":[139,167],"The":[140],"results":[141],"demonstrate":[142],"bypasses":[146],"unpacks":[150],"various":[154],"contrast":[157],"other":[159],"unpackers":[160],"can":[162],"handle":[163],"at":[164],"most":[165],"two":[166]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}