{"id":"https://openalex.org/W7131225582","doi":"https://doi.org/10.1109/apsec66846.2025.00078","title":"Chain of Command: Context-Aware Android Malware Detection via Permission-to-API Call Chains and Graph Representation Learning","display_name":"Chain of Command: Context-Aware Android Malware Detection via Permission-to-API Call Chains and Graph Representation Learning","publication_year":2025,"publication_date":"2025-12-02","ids":{"openalex":"https://openalex.org/W7131225582","doi":"https://doi.org/10.1109/apsec66846.2025.00078"},"language":null,"primary_location":{"id":"doi:10.1109/apsec66846.2025.00078","is_oa":false,"landing_page_url":"https://doi.org/10.1109/apsec66846.2025.00078","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 32nd Asia-Pacific Software Engineering Conference (APSEC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5112859568","display_name":"Zhichao Shi","orcid":"https://orcid.org/0000-0002-1005-7372"},"institutions":[{"id":"https://openalex.org/I3019309368","display_name":"North Minzu University","ror":"https://ror.org/05xjevr11","country_code":"CN","type":"education","lineage":["https://openalex.org/I3019309368"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhichao Shi","raw_affiliation_strings":["North Minzu University,School of Computer Science and Engineering,Yinchuan,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Minzu University,School of Computer Science and Engineering,Yinchuan,China","institution_ids":["https://openalex.org/I3019309368"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016834181","display_name":"Qiang Han","orcid":"https://orcid.org/0000-0002-1436-2219"},"institutions":[{"id":"https://openalex.org/I3019309368","display_name":"North Minzu University","ror":"https://ror.org/05xjevr11","country_code":"CN","type":"education","lineage":["https://openalex.org/I3019309368"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiang Han","raw_affiliation_strings":["North Minzu University,School of Computer Science and Engineering,Yinchuan,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Minzu University,School of Computer Science and Engineering,Yinchuan,China","institution_ids":["https://openalex.org/I3019309368"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040055714","display_name":"Zihao Zhang","orcid":"https://orcid.org/0009-0001-9664-0218"},"institutions":[{"id":"https://openalex.org/I3019309368","display_name":"North Minzu University","ror":"https://ror.org/05xjevr11","country_code":"CN","type":"education","lineage":["https://openalex.org/I3019309368"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zihao Zhang","raw_affiliation_strings":["North Minzu University,School of Computer Science and Engineering,Yinchuan,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Minzu University,School of Computer Science and Engineering,Yinchuan,China","institution_ids":["https://openalex.org/I3019309368"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I3019309368"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"773","last_page":"784"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9866999983787537,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9866999983787537,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.0031999999191612005,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7378000020980835},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5705000162124634},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.5130000114440918},{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.47450000047683716},{"id":"https://openalex.org/keywords/dependency-graph","display_name":"Dependency graph","score":0.47209998965263367},{"id":"https://openalex.org/keywords/feature-learning","display_name":"Feature learning","score":0.44929999113082886},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.4442000091075897},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4429999887943268}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8479999899864197},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7378000020980835},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5705000162124634},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.5130000114440918},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.47450000047683716},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.47209998965263367},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.44929999113082886},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.4442000091075897},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4429999887943268},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.4390999972820282},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4088999927043915},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39629998803138733},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.37940001487731934},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.3725999891757965},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.3700000047683716},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.3481999933719635},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.30149999260902405},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.298799991607666},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.28929999470710754},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.26109999418258667},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.2581999897956848},{"id":"https://openalex.org/C2987255567","wikidata":"https://www.wikidata.org/wiki/Q33002955","display_name":"Knowledge graph","level":2,"score":0.25060001015663147}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/apsec66846.2025.00078","is_oa":false,"landing_page_url":"https://doi.org/10.1109/apsec66846.2025.00078","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 32nd Asia-Pacific Software Engineering Conference (APSEC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":48,"referenced_works":["https://openalex.org/W2122672392","https://openalex.org/W2140095007","https://openalex.org/W2168103835","https://openalex.org/W2313513770","https://openalex.org/W2407313496","https://openalex.org/W2606250847","https://openalex.org/W2744097819","https://openalex.org/W2752485287","https://openalex.org/W2767371019","https://openalex.org/W2943383044","https://openalex.org/W2963204406","https://openalex.org/W2982705228","https://openalex.org/W3007234217","https://openalex.org/W3037037884","https://openalex.org/W3097192014","https://openalex.org/W3110643640","https://openalex.org/W3112311055","https://openalex.org/W3120704879","https://openalex.org/W3125601055","https://openalex.org/W3147879240","https://openalex.org/W3193490676","https://openalex.org/W3202406575","https://openalex.org/W3208220695","https://openalex.org/W3209736367","https://openalex.org/W4206615225","https://openalex.org/W4213449907","https://openalex.org/W4226034576","https://openalex.org/W4309490546","https://openalex.org/W4381233012","https://openalex.org/W4385755457","https://openalex.org/W4387234384","https://openalex.org/W4388553121","https://openalex.org/W4392697189","https://openalex.org/W4394611553","https://openalex.org/W4396506213","https://openalex.org/W4396520530","https://openalex.org/W4401633919","https://openalex.org/W4403100518","https://openalex.org/W4403628430","https://openalex.org/W4403722482","https://openalex.org/W4407130842","https://openalex.org/W4408092332","https://openalex.org/W4408283181","https://openalex.org/W4408441669","https://openalex.org/W4408791049","https://openalex.org/W4409233275","https://openalex.org/W4411997068","https://openalex.org/W7127587852"],"related_works":[],"abstract_inverted_index":{"Android":[0,145],"malware":[1,182],"detection":[2,14,183],"has":[3],"become":[4],"increasingly":[5],"critical":[6],"as":[7],"mobile":[8],"applications":[9],"continue":[10],"to":[11,29,73,111,116],"proliferate.":[12],"Traditional":[13],"methods":[15,154],"primarily":[16],"rely":[17],"on":[18,55,142],"static":[19],"analysis":[20,101],"of":[21,49,102,165],"permissions":[22],"and":[23,35,87,120,158,172,180],"API":[24,76],"calls,":[25],"but":[26],"often":[27],"fail":[28],"capture":[30],"the":[31,56,80,103,163],"complex":[32],"behavioral":[33,118],"patterns":[34],"contextual":[36,81,167],"relationships":[37],"inherent":[38],"in":[39,155],"malicious":[40],"applications.":[41],"To":[42],"address":[43],"this":[44],"limitation,":[45],"we":[46],"introduce":[47],"Chain":[48,59],"Command,":[50],"a":[51,64,74,84,99,123,136,143],"novel":[52],"framework":[53,150],"centered":[54],"Permission-to-API":[57],"Call":[58],"(PACC).":[60],"A":[61],"PACC":[62],"represents":[63],"complete":[65],"execution":[66],"path":[67],"from":[68,127],"an":[69],"application":[70],"entry":[71],"point":[72],"sensitive":[75],"invocation,":[77],"effectively":[78],"preserving":[79],"link":[82],"between":[83],"required":[85],"permission":[86],"its":[88],"use.":[89],"Our":[90,160],"methodology":[91],"comprises":[92],"three":[93],"stages:":[94],"first,":[95],"extracting":[96],"PACCs":[97],"through":[98],"backward":[100],"application\u2019s":[104],"call":[105],"graph;":[106],"second,":[107],"performing":[108],"semantic":[109,170],"abstraction":[110],"map":[112],"concrete":[113],"method":[114],"signatures":[115],"generalized":[117],"categories;":[119],"third,":[121],"constructing":[122],"compact":[124],"behavior":[125],"graph":[126,173],"these":[128],"abstracted":[129],"chains,":[130],"which":[131],"is":[132],"then":[133],"classified":[134],"using":[135],"Graph":[137],"Attention":[138],"Network":[139],"(GAT).":[140],"Evaluation":[141],"large-scale":[144],"dataset":[146],"demonstrates":[147],"that":[148],"our":[149],"significantly":[151],"outperforms":[152],"state-of-the-art":[153],"both":[156],"accuracy":[157],"robustness.":[159],"findings":[161],"underscore":[162],"efficacy":[164],"integrating":[166],"feature":[168],"engineering,":[169],"abstraction,":[171],"representation":[174],"learning":[175],"for":[176],"developing":[177],"more":[178],"reliable":[179],"interpretable":[181],"systems.":[184]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-02-25T00:00:00"}