{"id":"https://openalex.org/W2168103835","doi":"https://doi.org/10.1145/2660267.2660359","title":"Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs","display_name":"Semantics-Aware Android Malware Classification Using Weighted Contextual API Dependency Graphs","publication_year":2014,"publication_date":"2014-11-03","ids":{"openalex":"https://openalex.org/W2168103835","doi":"https://doi.org/10.1145/2660267.2660359","mag":"2168103835"},"language":"en","primary_location":{"id":"doi:10.1145/2660267.2660359","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2660267.2660359","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100695047","display_name":"Mu Zhang","orcid":"https://orcid.org/0000-0001-5905-9515"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Mu Zhang","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059590465","display_name":"Yue Duan","orcid":null},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yue Duan","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073376805","display_name":"Heng Yin","orcid":"https://orcid.org/0000-0002-8942-7742"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Heng Yin","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5008606161","display_name":"Zhiruo Zhao","orcid":"https://orcid.org/0000-0002-6952-5337"},"institutions":[{"id":"https://openalex.org/I70983195","display_name":"Syracuse University","ror":"https://ror.org/025r5qe02","country_code":"US","type":"education","lineage":["https://openalex.org/I70983195"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhiruo Zhao","raw_affiliation_strings":["Syracuse University, Syracuse, NY, USA"],"affiliations":[{"raw_affiliation_string":"Syracuse University, Syracuse, NY, USA","institution_ids":["https://openalex.org/I70983195"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5100695047"],"corresponding_institution_ids":["https://openalex.org/I70983195"],"apc_list":null,"apc_paid":null,"fwci":40.6286,"has_fulltext":false,"cited_by_count":460,"citation_normalized_percentile":{"value":0.99903062,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1105","last_page":"1116"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9907000064849854,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9883999824523926,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8508177995681763},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8011620044708252},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.7651841640472412},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.7448606491088867},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.6171559691429138},{"id":"https://openalex.org/keywords/system-call","display_name":"System call","score":0.6062740087509155},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5976179838180542},{"id":"https://openalex.org/keywords/dependency-graph","display_name":"Dependency graph","score":0.5936515927314758},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4764155149459839},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.45089957118034363},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.41700437664985657},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.3489076495170593},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.26712745428085327},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.22656163573265076},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.18457797169685364},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.17622220516204834}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8508177995681763},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8011620044708252},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.7651841640472412},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.7448606491088867},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.6171559691429138},{"id":"https://openalex.org/C2778579508","wikidata":"https://www.wikidata.org/wiki/Q722192","display_name":"System call","level":2,"score":0.6062740087509155},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5976179838180542},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.5936515927314758},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4764155149459839},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.45089957118034363},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.41700437664985657},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3489076495170593},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.26712745428085327},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.22656163573265076},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.18457797169685364},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.17622220516204834}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/2660267.2660359","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2660267.2660359","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.707.8638","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.707.8638","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://security.riit.tsinghua.edu.cn/mediawiki/images/3/30/Zhang-DroidSIFT-CCS14.pdf","raw_type":"text"},{"id":"pmh:oai:ink.library.smu.edu.sg:sis_research-9179","is_oa":false,"landing_page_url":"https://ink.library.smu.edu.sg/sis_research/8176","pdf_url":null,"source":{"id":"https://openalex.org/S4306401925","display_name":"Singapore Management University Institutional Knowledge (InK) (Singapore Management University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I79891267","host_organization_name":"Singapore Management University","host_organization_lineage":["https://openalex.org/I79891267"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://doi.org/10.1145/2660267.2660359","raw_type":"Conference Proceeding Article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.41999998688697815,"display_name":"Partnerships for the goals","id":"https://metadata.un.org/sdg/17"}],"awards":[{"id":"https://openalex.org/G2319464414","display_name":null,"funder_award_id":"#1054605","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8760279217","display_name":null,"funder_award_id":"#1018217","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320308253","display_name":"McAfee","ror":"https://ror.org/01ek73717"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":34,"referenced_works":["https://openalex.org/W74055483","https://openalex.org/W79696261","https://openalex.org/W81879861","https://openalex.org/W134490355","https://openalex.org/W1578479379","https://openalex.org/W1630356589","https://openalex.org/W1865564993","https://openalex.org/W1943233084","https://openalex.org/W1956767865","https://openalex.org/W1963971515","https://openalex.org/W1983362322","https://openalex.org/W1985686072","https://openalex.org/W1988036170","https://openalex.org/W1992114977","https://openalex.org/W2003276999","https://openalex.org/W2041276426","https://openalex.org/W2058180826","https://openalex.org/W2059610428","https://openalex.org/W2067512661","https://openalex.org/W2068211976","https://openalex.org/W2092942461","https://openalex.org/W2122410182","https://openalex.org/W2122672392","https://openalex.org/W2125011234","https://openalex.org/W2131523719","https://openalex.org/W2140095007","https://openalex.org/W2152149943","https://openalex.org/W2166743230","https://openalex.org/W2166924764","https://openalex.org/W2187373861","https://openalex.org/W2399891510","https://openalex.org/W2403072371","https://openalex.org/W2911307284","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W2292240422","https://openalex.org/W2128389850","https://openalex.org/W3135174262","https://openalex.org/W2183925834","https://openalex.org/W3200508744","https://openalex.org/W4308353525","https://openalex.org/W4283578543","https://openalex.org/W4225094272","https://openalex.org/W4226034576","https://openalex.org/W1830372847"],"abstract_inverted_index":{"The":[0],"drastic":[1],"increase":[2],"of":[3,136,161,169],"Android":[4,23,79],"malware":[5,18,24,80,106,145,162,172],"has":[6],"led":[7],"to":[8,15,66,99,116],"a":[9,73,90,128,174,188],"strong":[10],"interest":[11],"in":[12,132],"developing":[13],"methods":[14,28],"automate":[16],"the":[17],"analysis":[19],"process.":[20],"Existing":[21],"automated":[22],"detection":[25,156],"and":[26,36,62,108,147,180],"classification":[27],"fall":[29],"into":[30],"two":[31],"general":[32],"categories:":[33],"1)":[34],"signature-based":[35],"2)":[37],"machine":[38],"learning-based.":[39],"Signature-based":[40],"approaches":[41],"can":[42,157],"be":[43],"easily":[44],"evaded":[45],"by":[46],"bytecode-level":[47],"transformation":[48,86],"attacks.":[49],"Prior":[50],"learning-based":[51],"works":[52],"extract":[53,89],"features":[54],"from":[55],"application":[56,119],"syntax,":[57],"rather":[58],"than":[59],"program":[60,97],"semantics,":[61],"are":[63],"also":[64],"subject":[65],"evasion.":[67],"In":[68],"this":[69],"paper,":[70],"we":[71,88,111],"propose":[72],"novel":[74],"semantic-based":[75],"approach":[76],"that":[77,153],"classifies":[78],"via":[81],"dependency":[82,94],"graphs.":[83],"To":[84,103],"battle":[85],"attacks,":[87],"weighted":[91],"contextual":[92],"API":[93],"graph":[95,113],"as":[96],"semantics":[98],"construct":[100],"feature":[101],"sets.":[102],"fight":[104],"against":[105],"variants":[107],"zero-day":[109,171],"malware,":[110],"introduce":[112],"similarity":[114],"metrics":[115],"uncover":[117],"homogeneous":[118],"behaviors":[120],"while":[121],"tolerating":[122],"minor":[123],"implementation":[124],"differences.":[125],"We":[126,139],"implement":[127],"prototype":[129],"system,":[130],"DroidSIFT,":[131],"23":[133],"thousand":[134],"lines":[135],"Java":[137],"code.":[138],"evaluate":[140],"our":[141,154,164],"system":[142],"using":[143],"2200":[144],"samples":[146],"13500":[148],"benign":[149],"samples.":[150],"Experiments":[151],"show":[152],"signature":[155],"correctly":[158],"label":[159],"93\\%":[160],"instances;":[163],"anomaly":[165],"detector":[166],"is":[167],"capable":[168],"detecting":[170],"with":[173],"low":[175],"false":[176,183],"negative":[177],"rate":[178,185],"(2\\%)":[179],"an":[181],"acceptable":[182],"positive":[184],"(5.15\\%)":[186],"for":[187],"vetting":[189],"purpose.":[190]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":13},{"year":2024,"cited_by_count":18},{"year":2023,"cited_by_count":18},{"year":2022,"cited_by_count":47},{"year":2021,"cited_by_count":51},{"year":2020,"cited_by_count":60},{"year":2019,"cited_by_count":52},{"year":2018,"cited_by_count":61},{"year":2017,"cited_by_count":59},{"year":2016,"cited_by_count":54},{"year":2015,"cited_by_count":23},{"year":2014,"cited_by_count":2}],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-10-10T00:00:00"}