{"id":"https://openalex.org/W7164017256","doi":"https://doi.org/10.1145/3748522.3779797","title":"ALARM: An Adaptive Android Malware Detection Framework with Leiden-based Clustering and Mixture-of-Experts Classification","display_name":"ALARM: An Adaptive Android Malware Detection Framework with Leiden-based Clustering and Mixture-of-Experts Classification","publication_year":2026,"publication_date":"2026-03-23","ids":{"openalex":"https://openalex.org/W7164017256","doi":"https://doi.org/10.1145/3748522.3779797"},"language":null,"primary_location":{"id":"doi:10.1145/3748522.3779797","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3748522.3779797","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 41st ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3748522.3779797","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5127899786","display_name":"Kyoungmin Roh","orcid":null},"institutions":[{"id":"https://openalex.org/I89015989","display_name":"Dankook University","ror":"https://ror.org/058pdbn81","country_code":"KR","type":"education","lineage":["https://openalex.org/I89015989"]}],"countries":["KR"],"is_corresponding":true,"raw_author_name":"Kyoungmin Roh","raw_affiliation_strings":["Department of Cybersecurity / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0005-5060-1255","affiliations":[{"raw_affiliation_string":"Department of Cybersecurity / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea","institution_ids":["https://openalex.org/I89015989"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075408268","display_name":"Seungmin Lee","orcid":"https://orcid.org/0000-0003-4909-6106"},"institutions":[{"id":"https://openalex.org/I89015989","display_name":"Dankook University","ror":"https://ror.org/058pdbn81","country_code":"KR","type":"education","lineage":["https://openalex.org/I89015989"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Seungmin Lee","raw_affiliation_strings":["Department of Software Science / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea"],"raw_orcid":"https://orcid.org/0009-0008-2547-8410","affiliations":[{"raw_affiliation_string":"Department of Software Science / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea","institution_ids":["https://openalex.org/I89015989"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064210973","display_name":"Seong-je Cho","orcid":"https://orcid.org/0000-0001-9917-0429"},"institutions":[{"id":"https://openalex.org/I89015989","display_name":"Dankook University","ror":"https://ror.org/058pdbn81","country_code":"KR","type":"education","lineage":["https://openalex.org/I89015989"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Seong-Je Cho","raw_affiliation_strings":["Department of Software Science / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0001-9917-0429","affiliations":[{"raw_affiliation_string":"Department of Software Science / Computer Security & OS Lab, Dankook University, Yongin-si, Gyeonggi-do, Republic of Korea","institution_ids":["https://openalex.org/I89015989"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5040514478","display_name":"Young-Sup Hwang","orcid":"https://orcid.org/0000-0002-8713-9253"},"institutions":[{"id":"https://openalex.org/I51926615","display_name":"Sun Moon University","ror":"https://ror.org/009e5cd49","country_code":"KR","type":"education","lineage":["https://openalex.org/I51926615"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Youngsup Hwang","raw_affiliation_strings":["Division of Computer Science and Engineering, Sunmoon University, Asan-si, Chungcheongnam-do, Republic of Korea"],"raw_orcid":"https://orcid.org/0000-0002-8713-9253","affiliations":[{"raw_affiliation_string":"Division of Computer Science and Engineering, Sunmoon University, Asan-si, Chungcheongnam-do, Republic of Korea","institution_ids":["https://openalex.org/I51926615"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5127899786"],"corresponding_institution_ids":["https://openalex.org/I89015989"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.9629132,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1283","last_page":"1290"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9261999726295471,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9261999726295471,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.03920000046491623,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11652","display_name":"Imbalanced Data Classification Techniques","score":0.0038999998942017555,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.7013000249862671},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.692799985408783},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6674000024795532},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.5401999950408936},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.504800021648407},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.48820000886917114},{"id":"https://openalex.org/keywords/boosting","display_name":"Boosting (machine learning)","score":0.35269999504089355},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.35199999809265137}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7524999976158142},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.7013000249862671},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.692799985408783},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6674000024795532},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.5401999950408936},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5318999886512756},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5245000123977661},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5095000267028809},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.504800021648407},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.48820000886917114},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.35199999809265137},{"id":"https://openalex.org/C2777984123","wikidata":"https://www.wikidata.org/wiki/Q9248237","display_name":"Pointwise","level":2,"score":0.32690000534057617},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.3084999918937683},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.2964000105857849},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2865999937057495},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.2809000015258789},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.28060001134872437},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.2565000057220459}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3748522.3779797","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3748522.3779797","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 41st ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3748522.3779797","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3748522.3779797","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 41st ACM/SIGAPP Symposium on Applied Computing","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W1593045043","https://openalex.org/W2150884987","https://openalex.org/W2897249806","https://openalex.org/W2941199301","https://openalex.org/W2949719129","https://openalex.org/W2963204406","https://openalex.org/W3147879240","https://openalex.org/W3212677680","https://openalex.org/W4210772651","https://openalex.org/W4285604261","https://openalex.org/W4293718192","https://openalex.org/W4312781290","https://openalex.org/W4381661839","https://openalex.org/W4382239503","https://openalex.org/W4385688277","https://openalex.org/W4387817957","https://openalex.org/W4389719707","https://openalex.org/W4394989762","https://openalex.org/W4400242636","https://openalex.org/W4403882736","https://openalex.org/W4404612305","https://openalex.org/W4405738532","https://openalex.org/W4405916916","https://openalex.org/W4408749888","https://openalex.org/W4410694394","https://openalex.org/W4410718472","https://openalex.org/W4411019690","https://openalex.org/W4415233534"],"related_works":[],"abstract_inverted_index":{"Android":[0,81],"malware":[1],"evolves":[2],"rapidly,":[3],"causing":[4],"significant":[5],"degradation":[6],"in":[7,26,135,141],"the":[8,67,74,145],"performance":[9,126],"of":[10,130,153],"conventional":[11,158],"machine":[12],"learning-based":[13],"detection":[14,77,125,159],"models.":[15],"This":[16],"phenomenon,":[17],"known":[18],"as":[19],"concept":[20,172],"drift,":[21],"occurs":[22],"when":[23],"models":[24],"trained":[25,134],"historical":[27],"applications":[28,82],"fail":[29],"to":[30,49,65,79,110],"accurately":[31],"detect":[32],"newly":[33],"emerging":[34],"malware.":[35],"To":[36],"address":[37],"this":[38,40],"challenge,":[39],"paper":[41],"introduces":[42],"ALARM,":[43],"a":[44,92,99],"retraining-free":[45],"hybrid":[46],"framework":[47],"designed":[48],"maintain":[50],"robustness":[51],"under":[52],"evolving":[53],"data":[54],"distributions.":[55],"ALARM":[56,119],"constructs":[57],"positive":[58],"pointwise":[59],"mutual":[60],"information(PPMI)-based":[61],"API":[62],"co-occurrence":[63],"graphs":[64],"capture":[66],"structural":[68],"dependencies":[69],"among":[70],"APIs":[71],"and":[72,98,122,139,155,167],"applies":[73],"Leiden":[75],"community":[76],"algorithm":[78],"group":[80],"with":[83],"similar":[84],"behavioral":[85],"characteristics":[86],"into":[87],"clusters.":[88],"For":[89],"each":[90],"cluster,":[91],"specialized":[93],"expert":[94,107],"classifier":[95],"is":[96],"trained,":[97],"Mixture-of-experts":[100],"(MoE)":[101],"based":[102,147],"on":[103,148],"cosine-similarity":[104],"dynamically":[105],"combines":[106],"predictions,":[108],"adapting":[109],"distribution":[111],"shifts":[112],"without":[113],"retraining.":[114],"Experimental":[115],"results":[116],"demonstrate":[117],"that":[118,164],"achieves":[120,150],"stable":[121],"high":[123],"long-term":[124],"over":[127],"six":[128],"years":[129],"real-world":[131],"data.":[132],"When":[133],"2014\u20132017":[136],"year":[137,143],"datasets":[138],"tested":[140],"2018\u20132023":[142],"samples,":[144],"variant":[146],"k-NN":[149],"an":[151],"F1-score":[152],"0.9008":[154],"consistently":[156],"outperforms":[157],"methods.":[160],"These":[161],"findings":[162],"confirm":[163],"Leiden-based":[165],"clustering":[166],"MoE":[168],"classification":[169],"effectively":[170],"mitigate":[171],"drift.":[173]},"counts_by_year":[],"updated_date":"2026-06-10T14:10:52.464848","created_date":"2026-06-10T00:00:00"}