{"id":"https://openalex.org/W7109967287","doi":"https://doi.org/10.1109/tifs.2025.3639962","title":"Interpretable Defense Against Structural Adversarial Attacks on Android Malware Detection","display_name":"Interpretable Defense Against Structural Adversarial Attacks on Android Malware Detection","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W7109967287","doi":"https://doi.org/10.1109/tifs.2025.3639962"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2025.3639962","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3639962","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Wenying Wei","orcid":"https://orcid.org/0000-0002-0836-877X"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":true,"raw_author_name":"Wenying Wei","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kaifa Zhao","orcid":"https://orcid.org/0000-0002-3102-7498"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Kaifa Zhao","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hao Zhou","orcid":"https://orcid.org/0000-0001-8890-9208"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Hao Zhou","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Jianfeng Li","orcid":"https://orcid.org/0000-0002-3453-0195"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianfeng Li","raw_affiliation_strings":["Xi’an Jiaotong University, Xi’an, China"],"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong University, Xi’an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shuohan Wu","orcid":null},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Shuohan Wu","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ming Fan","orcid":"https://orcid.org/0000-0002-9327-0987"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ming Fan","raw_affiliation_strings":["Xi’an Jiaotong University, Xi’an, China"],"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong University, Xi’an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xiapu Luo","orcid":"https://orcid.org/0000-0002-9082-3208"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Xiapu Luo","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ting Wang","orcid":"https://orcid.org/0000-0003-4927-5833"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ting Wang","raw_affiliation_strings":["Stony Brook, NY, USA"],"affiliations":[{"raw_affiliation_string":"Stony Brook, NY, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":null,"display_name":"Kai Zhou","orcid":"https://orcid.org/0000-0003-1383-2765"},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Kai Zhou","raw_affiliation_strings":["Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"],"affiliations":[{"raw_affiliation_string":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ting Liu","orcid":"https://orcid.org/0000-0002-7600-0934"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ting Liu","raw_affiliation_strings":["Xi’an Jiaotong University, Xi’an, China"],"affiliations":[{"raw_affiliation_string":"Xi’an Jiaotong University, Xi’an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"last","author":{"id":null,"display_name":"Yuzhe Tang","orcid":"https://orcid.org/0000-0002-8911-106X"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yuzhe Tang","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":11,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I14243506"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.60880283,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"13296","last_page":"13311"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9376999735832214,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9376999735832214,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0430000014603138,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.004800000227987766,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.895799994468689},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6599000096321106},{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.5547000169754028},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.5200999975204468},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.5188999772071838},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5170000195503235},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.5105999708175659},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.5027999877929688},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.4523000121116638}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.895799994468689},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8702999949455261},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6599000096321106},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6007999777793884},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.5547000169754028},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.5200999975204468},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.5188999772071838},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5170000195503235},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.5105999708175659},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.5027999877929688},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.4523000121116638},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.439300000667572},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.4140999913215637},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.3714999854564667},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3643999993801117},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.35010001063346863},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3271999955177307},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.32589998841285706},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.3102000057697296},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.3025999963283539},{"id":"https://openalex.org/C153180980","wikidata":"https://www.wikidata.org/wiki/Q19776675","display_name":"Commit","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C2776527387","wikidata":"https://www.wikidata.org/wiki/Q1671839","display_name":"Invocation","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C89377073","wikidata":"https://www.wikidata.org/wiki/Q1171224","display_name":"Indirection","level":2,"score":0.2937000095844269},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29109999537467957},{"id":"https://openalex.org/C59577422","wikidata":"https://www.wikidata.org/wiki/Q10265143","display_name":"False accusation","level":2,"score":0.26969999074935913},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.267300009727478},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2596000134944916},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.25870001316070557},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.25699999928474426},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.25440001487731934}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3639962","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3639962","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.8110815286636353,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G1259930355","display_name":null,"funder_award_id":"62272377","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G1828253250","display_name":null,"funder_award_id":"62232014","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2148484985","display_name":null,"funder_award_id":"62202405","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W1197477582","https://openalex.org/W1971497680","https://openalex.org/W2038296020","https://openalex.org/W2087970742","https://openalex.org/W2122672392","https://openalex.org/W2139806091","https://openalex.org/W2140095007","https://openalex.org/W2324464293","https://openalex.org/W2516809705","https://openalex.org/W2613110208","https://openalex.org/W2749572357","https://openalex.org/W2960973085","https://openalex.org/W2962843949","https://openalex.org/W2962858109","https://openalex.org/W2963777745","https://openalex.org/W2964136807","https://openalex.org/W2966270452","https://openalex.org/W2966342255","https://openalex.org/W2984482968","https://openalex.org/W3000120900","https://openalex.org/W3000239448","https://openalex.org/W3002912819","https://openalex.org/W3005073185","https://openalex.org/W3005086430","https://openalex.org/W3015481738","https://openalex.org/W3035106315","https://openalex.org/W3036847733","https://openalex.org/W3097730806","https://openalex.org/W3168561516","https://openalex.org/W3200583622","https://openalex.org/W3211182750","https://openalex.org/W3212677680","https://openalex.org/W4244726870","https://openalex.org/W4287849792","https://openalex.org/W4294559022","https://openalex.org/W4362703128","https://openalex.org/W4376606897","https://openalex.org/W4385270159","https://openalex.org/W4385627058","https://openalex.org/W4388857307"],"related_works":[],"abstract_inverted_index":{"Android,":[0],"being":[1],"one":[2],"of":[3,19,39,63,129,148,162,172],"the":[4,17,37,61,64,78,127,146,170,230],"most":[5],"widely":[6],"used":[7],"mobile":[8],"systems,":[9,24],"is":[10,50,155],"facing":[11],"pressing":[12],"threats":[13],"from":[14],"malware.":[15,125,211],"Despite":[16],"effectiveness":[18],"Android":[20,97],"malware":[21,150],"detection":[22,65,79,147,231],"(AMD)":[23],"they":[25],"are":[26],"still":[27],"vulnerable":[28],"to":[29,69,102,117,135,190,226,235],"state-of-the-art":[30,180],"adversarial":[31,85,124,137,149,163,210],"attacks.":[32,107],"Existing":[33],"defense":[34,202],"methods":[35],"require":[36],"knowledge":[38,161],"target":[40],"adversaries,":[41],"such":[42],"as":[43],"attack":[44],"algorithms":[45],"or":[46],"obfuscation":[47],"strategies,":[48],"which":[49,74,144],"impractical":[51],"in":[52,123,217],"real-world":[53],"scenarios.":[54],"Additionally,":[55],"these":[56],"approaches":[57],"may":[58],"adversely":[59],"affect":[60],"performance":[62,171],"model":[66],"and":[67,121,165,228],"fail":[68],"defend":[70,105],"against":[71,106],"problem-space":[72],"attacks,":[73],"not":[75],"only":[76],"deceive":[77,191],"models":[80,164],"but":[81],"also":[82],"generate":[83],"executable":[84],"software.":[86],"To":[87],"address":[88],"this":[89],"research":[90],"gap,":[91],"we":[92],"propose":[93],"a":[94,111,133],"novel":[95,112],"interpretable":[96],"guard":[98],"system,":[99],"named":[100],"IADGuard,":[101],"help":[103],"AMD":[104,208],"IADGuard":[108,131,158,177,198,222],"first":[109],"designs":[110],"graph":[113],"explainable":[114],"method,":[115],"AGExplainer,":[116,130],"identify":[118,209],"suspicious":[119],"functions":[120],"invocations":[122],"With":[126],"guidance":[128],"develops":[132],"rectifier":[134],"reverse":[136],"modifications":[138],"on":[139],"apps\u2019":[140,186],"function":[141,187],"invocation":[142,188],"relations,":[143],"facilitates":[145],"by":[151,233],"victim":[152,166,173,192,207],"AMD.":[153,174,193],"It":[154],"noteworthy":[156],"that":[157,184,197],"requires":[159],"zero":[160],"models,":[167],"thereby":[168],"preserves":[169],"We":[175],"validate":[176],"over":[178,200],"three":[179],"problem":[181],"space":[182],"attacks":[183],"modify":[185],"relations":[189],"Experimental":[194],"results":[195],"show":[196],"achieves":[199],"90.5%":[201],"success":[203],"rate,":[204],"i.e.,":[205],"helps":[206,221],"Furthermore,":[212],"AGExplainer":[213],"surpasses":[214],"representative":[215],"interpreters":[216],"identifying":[218],"essential":[219],"modifications,":[220],"reduce":[223],"false":[224],"positives":[225],"1.5%,":[227],"improves":[229],"efficiency":[232],"up":[234],"10.4":[236],"times.":[237]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-12-08T00:00:00"}