{"id":"https://openalex.org/W3015902623","doi":"https://doi.org/10.1145/3382158","title":"A Data-driven Characterization of Modern Android Spyware","display_name":"A Data-driven Characterization of Modern Android Spyware","publication_year":2020,"publication_date":"2020-03-31","ids":{"openalex":"https://openalex.org/W3015902623","doi":"https://doi.org/10.1145/3382158","mag":"3015902623"},"language":"en","primary_location":{"id":"doi:10.1145/3382158","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3382158","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3382158","source":{"id":"https://openalex.org/S4210170305","display_name":"ACM Transactions on Management Information Systems","issn_l":"2158-656X","issn":["2158-656X","2158-6578"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Management Information Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3382158","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072597369","display_name":"Fabio Pierazzi","orcid":"https://orcid.org/0000-0002-1254-1758"},"institutions":[{"id":"https://openalex.org/I183935753","display_name":"King's College London","ror":"https://ror.org/0220mzb33","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I183935753"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Fabio Pierazzi","raw_affiliation_strings":["King\u2019s College London, UK","King's College London, UK"],"raw_orcid":"https://orcid.org/0000-0002-1254-1758","affiliations":[{"raw_affiliation_string":"King\u2019s College London, UK","institution_ids":["https://openalex.org/I183935753"]},{"raw_affiliation_string":"King's College London, UK","institution_ids":["https://openalex.org/I183935753"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103083194","display_name":"Ghita Mezzour","orcid":"https://orcid.org/0000-0002-4306-1589"},"institutions":[{"id":"https://openalex.org/I4210106663","display_name":"International University of Rabat","ror":"https://ror.org/01t9czq80","country_code":"MA","type":"education","lineage":["https://openalex.org/I4210106663"]}],"countries":["MA"],"is_corresponding":false,"raw_author_name":"Ghita Mezzour","raw_affiliation_strings":["International University of Rabat, FIL, TICLab, Morocco"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"International University of Rabat, FIL, TICLab, Morocco","institution_ids":["https://openalex.org/I4210106663"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080549266","display_name":"Qian Han","orcid":"https://orcid.org/0000-0002-4583-7598"},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qian Han","raw_affiliation_strings":["Dartmouth College, Hanover, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dartmouth College, Hanover, USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073709427","display_name":"Michele Colajanni","orcid":"https://orcid.org/0000-0002-9499-1559"},"institutions":[{"id":"https://openalex.org/I122346577","display_name":"University of Modena and Reggio Emilia","ror":"https://ror.org/02d4c4y02","country_code":"IT","type":"education","lineage":["https://openalex.org/I122346577"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Michele Colajanni","raw_affiliation_strings":["University of Modena and Reggio Emilia, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Modena and Reggio Emilia, Italy","institution_ids":["https://openalex.org/I122346577"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5038645035","display_name":"V. S. Subrahmanian","orcid":"https://orcid.org/0000-0001-7191-0296"},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"V. S. Subrahmanian","raw_affiliation_strings":["Dartmouth College, Hanover, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Dartmouth College, Hanover, USA","institution_ids":["https://openalex.org/I107672454"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5072597369"],"corresponding_institution_ids":["https://openalex.org/I183935753"],"apc_list":null,"apc_paid":null,"fwci":2.8871,"has_fulltext":true,"cited_by_count":31,"citation_normalized_percentile":{"value":0.91556194,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":"11","issue":"1","first_page":"1","last_page":"38"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9901999831199646,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.988099992275238,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8725259304046631},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.8082718849182129},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.6203570365905762},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5944013595581055},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5912255048751831},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.25283199548721313}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8725259304046631},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.8082718849182129},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.6203570365905762},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5944013595581055},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5912255048751831},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.25283199548721313}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3382158","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3382158","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3382158","source":{"id":"https://openalex.org/S4210170305","display_name":"ACM Transactions on Management Information Systems","issn_l":"2158-656X","issn":["2158-656X","2158-6578"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Management Information Systems","raw_type":"journal-article"},{"id":"pmh:oai:cris.unibo.it:11585/811609","is_oa":false,"landing_page_url":"http://hdl.handle.net/11585/811609","pdf_url":null,"source":{"id":"https://openalex.org/S4306402579","display_name":"Archivio istituzionale della ricerca (Alma Mater Studiorum Universit\u00e0 di Bologna)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210117483","host_organization_name":"Istituto di Ematologia di Bologna","host_organization_lineage":["https://openalex.org/I4210117483"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:iris.unimore.it:11380/1200672","is_oa":true,"landing_page_url":"http://hdl.handle.net/11380/1200672","pdf_url":null,"source":{"id":"https://openalex.org/S4306400718","display_name":"IRIS UNIMORE (University of Modena and Reggio Emilia)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I122346577","host_organization_name":"University of Modena and Reggio Emilia","host_organization_lineage":["https://openalex.org/I122346577"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1145/3382158","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3382158","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3382158","source":{"id":"https://openalex.org/S4210170305","display_name":"ACM Transactions on Management Information Systems","issn_l":"2158-656X","issn":["2158-656X","2158-6578"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Management Information Systems","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6700000166893005,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1392126688","display_name":null,"funder_award_id":"N00014-16-1-2896","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G2286963721","display_name":null,"funder_award_id":"W911NF1410358","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"},{"id":"https://openalex.org/G3232332326","display_name":null,"funder_award_id":"grants N00014-15-1-2007 and N00014-16-1-2896","funder_id":"https://openalex.org/F4320338298","funder_display_name":"Office of Naval Research Global"},{"id":"https://openalex.org/G6959850709","display_name":null,"funder_award_id":"N00014-15-1-2007","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G8876996369","display_name":null,"funder_award_id":"N00014","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"}],"funders":[{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"},{"id":"https://openalex.org/F4320338298","display_name":"Office of Naval Research Global","ror":"https://ror.org/00rk2pe57"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3015902623.pdf","grobid_xml":"https://content.openalex.org/works/W3015902623.grobid-xml"},"referenced_works_count":66,"referenced_works":["https://openalex.org/W34283345","https://openalex.org/W132347231","https://openalex.org/W1491356120","https://openalex.org/W1552906779","https://openalex.org/W1581009051","https://openalex.org/W1647869403","https://openalex.org/W1865564993","https://openalex.org/W1943233084","https://openalex.org/W1963971515","https://openalex.org/W1969381345","https://openalex.org/W1983470191","https://openalex.org/W1984043601","https://openalex.org/W1990649188","https://openalex.org/W2003063963","https://openalex.org/W2014589236","https://openalex.org/W2017025011","https://openalex.org/W2034814641","https://openalex.org/W2060692877","https://openalex.org/W2085700758","https://openalex.org/W2087804676","https://openalex.org/W2096921767","https://openalex.org/W2105037940","https://openalex.org/W2105292817","https://openalex.org/W2122672392","https://openalex.org/W2123519624","https://openalex.org/W2125011234","https://openalex.org/W2126401948","https://openalex.org/W2139351881","https://openalex.org/W2153497135","https://openalex.org/W2159922008","https://openalex.org/W2164956449","https://openalex.org/W2166743230","https://openalex.org/W2168103835","https://openalex.org/W2208157769","https://openalex.org/W2224173700","https://openalex.org/W2258956667","https://openalex.org/W2276979642","https://openalex.org/W2290781924","https://openalex.org/W2296579688","https://openalex.org/W2318851192","https://openalex.org/W2334842536","https://openalex.org/W2376050373","https://openalex.org/W2408793237","https://openalex.org/W2464629196","https://openalex.org/W2475334473","https://openalex.org/W2487124337","https://openalex.org/W2505170670","https://openalex.org/W2511353470","https://openalex.org/W2531970759","https://openalex.org/W2591102410","https://openalex.org/W2603160474","https://openalex.org/W2612281133","https://openalex.org/W2612622960","https://openalex.org/W2613948935","https://openalex.org/W2620649268","https://openalex.org/W2624268855","https://openalex.org/W2749928722","https://openalex.org/W2791557545","https://openalex.org/W2794995912","https://openalex.org/W2796498984","https://openalex.org/W2888121333","https://openalex.org/W2894278110","https://openalex.org/W2904792378","https://openalex.org/W2964136807","https://openalex.org/W4289257300","https://openalex.org/W4290757805"],"related_works":["https://openalex.org/W2527064328","https://openalex.org/W4296870407","https://openalex.org/W2591124010","https://openalex.org/W3211751213","https://openalex.org/W1981999315","https://openalex.org/W3012546138","https://openalex.org/W2940924828","https://openalex.org/W2049127243","https://openalex.org/W2187802414","https://openalex.org/W2752008282"],"abstract_inverted_index":{"According":[0],"to":[1,62,139],"Nokia\u2019s":[2],"2017":[3],"Threat":[4],"Intelligence":[5],"Report,":[6],"68.5%":[7],"of":[8,43,77,96,134,150,180,187],"malware":[9,50],"targets":[10],"the":[11,38,44,58,97,132,151,181],"Android":[12,28,49,103,113,188],"platform;":[13],"Windows":[14],"is":[15,213],"second":[16],"with":[17,25],"28%,":[18],"followed":[19],"by":[20],"iOS":[21],"and":[22,41,70,111,118,154,170,206],"other":[23,112,172],"platforms":[24],"3.5%.":[26],"The":[27],"spyware":[29,56,78,104,166],"family":[30],"U":[31,190],"A":[32,86,191,207],"P":[33,192,195],"USH":[34,193],"was":[35],"responsible":[36],"for":[37],"most":[39,47],"infections,":[40],"several":[42,149],"top":[45],"20":[46],"common":[48],"were":[51],"spyware.":[52],"Simply":[53],"put,":[54],"modern":[55,102],"steals":[57],"basic":[59],"information":[60],"needed":[61],"fuel":[63],"more":[64],"deadly":[65],"attacks":[66],"such":[67],"as":[68,82],"ransomware":[69],"banking":[71,83],"fraud.":[72],"Not":[73],"surprisingly,":[74],"some":[75],"forms":[76],"are":[79],"also":[80],"classified":[81],"trojans":[84],"(e.g.,":[85],"CE":[87,208],"C":[88,209],"ARD":[89,210],").":[90],"We":[91,144],"present":[92,176],"a":[93,141,177,214],"data-driven":[94],"characterization":[95],"principal":[98],"factors":[99,182],"that":[100,130,146,164],"distinguish":[101,165],"(July":[105],"2016\u2013July":[106],"2017)":[107],"both":[108,116,167],"from":[109,168,171],"goodware":[110,169],"malware,":[114],"using":[115],"traditional":[117,153],"deep":[119,155],"ML.":[120],"First,":[121],"we":[122,159,175],"propose":[123],"an":[124],"Ensemble":[125],"Late":[126],"Fusion":[127],"(ELF)":[128],"architecture":[129],"combines":[131],"results":[133],"multiple":[135],"classifiers\u2019":[136],"predicted":[137],"probabilities":[138],"generate":[140],"final":[142],"prediction.":[143],"show":[145],"ELF":[147],"outperforms":[148],"best-known":[152],"learning":[156],"classifiers.":[157],"Second,":[158],"automatically":[160],"identify":[161],"key":[162],"features":[163],"malware.":[173],"Finally":[174],"detailed":[178],"analysis":[179],"distinguishing":[183],"five":[184],"important":[185],"families":[186],"spyware:":[189],",":[194,197,202,205],"INCER":[196],"H":[198,200],"E":[199,201],"USBC":[203],"LEAVER":[204],"(the":[211],"last":[212],"hybrid":[215],"spyware-banking":[216],"trojan).":[217]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":8},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":5}],"updated_date":"2026-05-27T09:02:27.158192","created_date":"2025-10-10T00:00:00"}