{"id":"https://openalex.org/W4413392566","doi":"https://doi.org/10.1109/tifs.2025.3601338","title":"UTRDCL: Stealthy DCL-Based Obfuscation and Its Attacks and Defenses in Android","display_name":"UTRDCL: Stealthy DCL-Based Obfuscation and Its Attacks and Defenses in Android","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4413392566","doi":"https://doi.org/10.1109/tifs.2025.3601338"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2025.3601338","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3601338","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102208696","display_name":"Zhao Xin","orcid":"https://orcid.org/0009-0004-9336-1880"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Zhao","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0009-0004-9336-1880","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101682487","display_name":"Hao Han","orcid":"https://orcid.org/0000-0002-7912-027X"},"institutions":[{"id":"https://openalex.org/I9842412","display_name":"Nanjing University of Aeronautics and Astronautics","ror":"https://ror.org/01scyh794","country_code":"CN","type":"education","lineage":["https://openalex.org/I9842412"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Han","raw_affiliation_strings":["Nanjing University of Aeronautics and Astronautics, Nanjing, China","Nanjing University of Aeronautics and Astronautics, China"],"raw_orcid":"https://orcid.org/0000-0002-7912-027X","affiliations":[{"raw_affiliation_string":"Nanjing University of Aeronautics and Astronautics, Nanjing, China","institution_ids":["https://openalex.org/I9842412"]},{"raw_affiliation_string":"Nanjing University of Aeronautics and Astronautics, China","institution_ids":["https://openalex.org/I9842412"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023954841","display_name":"Hao Wu","orcid":"https://orcid.org/0000-0002-0980-9805"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Wu","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-0980-9805","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060268538","display_name":"Sheng Zhong","orcid":"https://orcid.org/0000-0002-6581-8730"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sheng Zhong","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-6581-8730","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5114549816","display_name":"Fengyuan Xu","orcid":"https://orcid.org/0000-0003-3388-7544"},"institutions":[{"id":"https://openalex.org/I881766915","display_name":"Nanjing University","ror":"https://ror.org/01rxvg760","country_code":"CN","type":"education","lineage":["https://openalex.org/I881766915"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengyuan Xu","raw_affiliation_strings":["National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-3388-7544","affiliations":[{"raw_affiliation_string":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]},{"raw_affiliation_string":"National Key Lab for Novel Software Technology, Nanjing University, Nanjing, China","institution_ids":["https://openalex.org/I881766915"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.22438795,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"9068","last_page":"9083"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9952999949455261,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9908000230789185,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.8894333839416504},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7860935926437378},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.681416928768158},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.662561297416687},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.47479572892189026},{"id":"https://openalex.org/keywords/android-application","display_name":"Android application","score":0.45366010069847107},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.37546491622924805},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.28480714559555054}],"concepts":[{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.8894333839416504},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7860935926437378},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.681416928768158},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.662561297416687},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.47479572892189026},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.45366010069847107},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.37546491622924805},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.28480714559555054}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3601338","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3601338","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1028567220","display_name":null,"funder_award_id":"62272224","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2166296455","display_name":null,"funder_award_id":"62302207","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2379088649","display_name":null,"funder_award_id":"62272215","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3184683627","display_name":null,"funder_award_id":"62432004","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7601562830","display_name":"\u591a\u65b9\u8054\u5408\u6df1\u5ea6\u5b66\u4e60\u4e2d\u7528\u6237\u6570\u636e\u9690\u79c1\u6cc4\u9732\u95ee\u9898\u7814\u7a76","funder_award_id":"61872176","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W2014390890","https://openalex.org/W2046843253","https://openalex.org/W2059610428","https://openalex.org/W2122672392","https://openalex.org/W2126667017","https://openalex.org/W2182464523","https://openalex.org/W2293796484","https://openalex.org/W2532717356","https://openalex.org/W2583329118","https://openalex.org/W2740060156","https://openalex.org/W2751855490","https://openalex.org/W2792393499","https://openalex.org/W2811320115","https://openalex.org/W2897230315","https://openalex.org/W2900275727","https://openalex.org/W2906631928","https://openalex.org/W2920712496","https://openalex.org/W2954715925","https://openalex.org/W2959859531","https://openalex.org/W2963649998","https://openalex.org/W2995812021","https://openalex.org/W3006711782","https://openalex.org/W3007553983","https://openalex.org/W3016369654","https://openalex.org/W4290652245"],"related_works":["https://openalex.org/W2591124010","https://openalex.org/W4281384336","https://openalex.org/W2889975722","https://openalex.org/W2781346976","https://openalex.org/W2401343441","https://openalex.org/W4291961149","https://openalex.org/W3191784636","https://openalex.org/W4387947354","https://openalex.org/W4287100773","https://openalex.org/W3181948684"],"abstract_inverted_index":{"Dynamic":[0],"Class":[1],"Loading":[2],"(DCL)":[3],"is":[4,223],"a":[5,27,78,138,144,170],"legitimate":[6],"technique":[7,30,82],"extensively":[8],"used":[9,126],"by":[10,112,142,167],"Android":[11,150],"developers":[12],"to":[13,31,99,127],"incorporate":[14],"additional":[15],"functionalities":[16],"into":[17,115],"applications":[18],"at":[19],"runtime.":[20],"However,":[21],"adversaries":[22],"can":[23,124,184],"exploit":[24],"DCL":[25,70],"as":[26,52],"stealthy":[28,80],"obfuscation":[29,46,81],"dynamically":[32],"load":[33],"malicious":[34],"code":[35],"and":[36,47,92,118,136,193,220],"evade":[37,128,185],"detection.":[38,129,176],"While":[39],"prior":[40],"studies":[41],"have":[42],"analyzed":[43],"typical":[44],"DCL-based":[45],"the":[48,149,163],"attacks":[49,181,211],"it":[50,114,123],"enables\u2014such":[51],"identifying":[53],"payloads":[54],"on":[55,104,202],"storage,":[56],"inspecting":[57],"DCL-related":[58,90],"APIs,":[59,91],"or":[60],"profiling":[61],"dynamic":[62],"behaviors\u2014existing":[63],"solutions":[64],"remain":[65],"insufficient":[66],"against":[67],"increasingly":[68],"evasive":[69],"threats.":[71],"In":[72],"this":[73,156],"paper,":[74],"we":[75,106,134],"propose":[76],"UTRDCL,":[77,105,168],"novel":[79],"that":[83,152,180],"leverages":[84],"system":[85,151],"APIs":[86],"instead":[87],"of":[88,218],"conventional":[89],"employs":[93],"an":[94],"automated":[95],"footprint":[96],"cleanup":[97],"strategy":[98],"minimize":[100],"runtime":[101],"traces.":[102],"Based":[103],"construct":[107],"three":[108],"real-world":[109],"attack":[110,164],"instances":[111],"embedding":[113],"existing":[116],"malware":[117,188],"benign":[119],"applications,":[120],"demonstrating":[121,205],"how":[122],"be":[125],"To":[130],"counter":[131],"such":[132],"threats,":[133],"design":[135],"implement":[137],"lightweight":[139],"defense":[140,173,200,222],"mechanism":[141,201],"patching":[143],"previously":[145],"overlooked":[146],"vulnerability":[147],"in":[148,155,208],"UTRDCL":[153,183,219],"exploits":[154],"specific":[157],"context.":[158],"This":[159],"system-level":[160],"mitigation":[161],"closes":[162],"surface":[165],"leveraged":[166],"offering":[169],"more":[171],"fundamental":[172],"than":[174],"behavioral":[175],"Extensive":[177],"experiments":[178],"show":[179],"leveraging":[182],"11":[186],"state-of-the-art":[187],"detectors":[189],"from":[190],"open-source,":[191],"academic,":[192],"commercial":[194],"sources.":[195],"We":[196],"further":[197],"validate":[198],"our":[199],"real":[203],"devices,":[204],"its":[206,221],"effectiveness":[207],"preventing":[209],"UTRDCL-based":[210],"without":[212],"introducing":[213],"noticeable":[214],"overhead.":[215],"Our":[216],"proof-of-concept":[217],"publicly":[224],"available1.":[225]},"counts_by_year":[],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}