{"id":"https://openalex.org/W7155434800","doi":"https://doi.org/10.31449/inf.v50i11.10831","title":"MLSTM: A GraphSAGE-based Android Malware Detection Method Integrating Mean Aggregation and LSTM","display_name":"MLSTM: A GraphSAGE-based Android Malware Detection Method Integrating Mean Aggregation and LSTM","publication_year":2026,"publication_date":"2026-04-23","ids":{"openalex":"https://openalex.org/W7155434800","doi":"https://doi.org/10.31449/inf.v50i11.10831"},"language":null,"primary_location":{"id":"doi:10.31449/inf.v50i11.10831","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i11.10831","pdf_url":null,"source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.31449/inf.v50i11.10831","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134461064","display_name":"Yi Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I1336834208","display_name":"Management and Science University","ror":"https://ror.org/027zr9y17","country_code":"MY","type":"education","lineage":["https://openalex.org/I1336834208"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Yi Liu","raw_affiliation_strings":["Jiujiang Polytechnic University of Science and Technology, Jiujiang 332020 , China  and School of Graduate Studies, Management and Science University, Shah Alam 40100, Malaysia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Jiujiang Polytechnic University of Science and Technology, Jiujiang 332020 , China  and School of Graduate Studies, Management and Science University, Shah Alam 40100, Malaysia","institution_ids":["https://openalex.org/I1336834208"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134380030","display_name":"Md Gapar Md Johar","orcid":null},"institutions":[{"id":"https://openalex.org/I1336834208","display_name":"Management and Science University","ror":"https://ror.org/027zr9y17","country_code":"MY","type":"education","lineage":["https://openalex.org/I1336834208"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Md Gapar Md Johar","raw_affiliation_strings":["School of Graduate Studies, Management and Science University, Shah Alam 40100, Malaysia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Graduate Studies, Management and Science University, Shah Alam 40100, Malaysia","institution_ids":["https://openalex.org/I1336834208"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5046850077","display_name":"Jacquline Tham","orcid":"https://orcid.org/0000-0003-0966-2425"},"institutions":[{"id":"https://openalex.org/I1336834208","display_name":"Management and Science University","ror":"https://ror.org/027zr9y17","country_code":"MY","type":"education","lineage":["https://openalex.org/I1336834208"]}],"countries":["MY"],"is_corresponding":false,"raw_author_name":"Jacquline Tham","raw_affiliation_strings":["Software Engineering and Digital Innovation Centre, Management and Science University, Shah Alam 40100, Malaysia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Software Engineering and Digital Innovation Centre, Management and Science University, Shah Alam 40100, Malaysia","institution_ids":["https://openalex.org/I1336834208"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I1336834208"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.49328063,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"50","issue":"11","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9860000014305115,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9860000014305115,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.003100000089034438,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0017000000225380063,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.7687000036239624},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.677299976348877},{"id":"https://openalex.org/keywords/opcode","display_name":"Opcode","score":0.5066999793052673},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4803999960422516},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.4754999876022339},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.4133000075817108},{"id":"https://openalex.org/keywords/mean-squared-error","display_name":"Mean squared error","score":0.40209999680519104}],"concepts":[{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.7687000036239624},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7621999979019165},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.677299976348877},{"id":"https://openalex.org/C52173422","wikidata":"https://www.wikidata.org/wiki/Q766483","display_name":"Opcode","level":2,"score":0.5066999793052673},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4803999960422516},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.4754999876022339},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.4133000075817108},{"id":"https://openalex.org/C139945424","wikidata":"https://www.wikidata.org/wiki/Q1940696","display_name":"Mean squared error","level":2,"score":0.40209999680519104},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3982999920845032},{"id":"https://openalex.org/C140745168","wikidata":"https://www.wikidata.org/wiki/Q1210082","display_name":"Tree traversal","level":2,"score":0.373199999332428},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37290000915527344},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.37059998512268066},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.3375999927520752},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.32850000262260437},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2904999852180481},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2734000086784363},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C115178988","wikidata":"https://www.wikidata.org/wiki/Q772067","display_name":"Laplacian matrix","level":3,"score":0.259799987077713},{"id":"https://openalex.org/C40969351","wikidata":"https://www.wikidata.org/wiki/Q3516228","display_name":"Word error rate","level":2,"score":0.25679999589920044}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.31449/inf.v50i11.10831","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i11.10831","pdf_url":null,"source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.31449/inf.v50i11.10831","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i11.10831","pdf_url":null,"source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6178221702575684}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"With":[0],"the":[1,8,18,45,70,88,126,146,157,175,182,187,221,233],"popularity":[2],"of":[3,10,23,55,73,150,159,190,227],"smartphones":[4],"and":[5,20,32,48,62,76,99,119,131,139,153,165,212,223,236,238],"mobile":[6],"applications,":[7],"threat":[9],"Android":[11,24,217,245],"malware":[12,246],"is":[13,42,145,161,193],"increasingly":[14],"serious.":[15],"To":[16],"realize":[17],"efficient":[19],"accurate":[21],"detection":[22,27,143,208],"malware,":[25],"a":[26,240],"method":[28,41,205,231],"combining":[29],"mean":[30,133],"aggregator":[31],"long-term":[33,79],"short-term":[34,80],"memory":[35,81],"(MLSTM)":[36],"has":[37,125,206],"been":[38],"proposed.":[39],"This":[40,195,230],"based":[43,58],"on":[44,59,97],"graph":[46,54,116],"sample":[47],"aggregate":[49],"framework.":[50],"Construct":[51],"an":[52,56],"isomorphic":[53],"application":[57],"permission":[60,151,177],"requests":[61],"third-party":[63,154],"library":[64,155],"call":[65],"features.":[66,178],"MLSTM":[67,124,160,191],"first":[68],"aggregates":[69],"average":[71,109,128],"features":[72,152],"adjacent":[74],"nodes,":[75],"then":[77],"uses":[78],"(LSTM)":[82],"to":[83,215],"process":[84],"sequence":[85],"information,":[86],"generating":[87],"final":[89],"node":[90],"embeddings":[91],"for":[92,244],"classification.":[93],"The":[94,203],"test":[95],"results":[96],"AndroZoo":[98],"VirusShare":[100],"datasets":[101],"show":[102],"that":[103],"compared":[104],"with":[105],"baseline":[106],"models":[107],"including":[108],"aggregator,":[110,112,115],"LSTM":[111],"max":[113],"pool":[114],"convolution":[117],"network,":[118],"gated":[120],"recurrent":[121],"unit":[122],"(GRU),":[123],"smallest":[127],"absolute":[129],"error":[130],"root":[132],"square":[134],"error,":[135],"which":[136],"are":[137],"3.84":[138],"6.26,":[140],"respectively.":[141],"Its":[142],"performance":[144],"best.":[147],"In":[148,179],"terms":[149],"features,":[156],"accuracy":[158],"(98.85":[162],"\u00b1":[163,167],"0.12)%":[164],"(92.58":[166],"0.25)%,":[168],"respectively,":[169],"significantly":[170],"higher":[171],"than":[172],"GRU":[173],"under":[174,181],"same":[176],"addition,":[180],"projected":[183],"gradient":[184],"descent":[185],"attack,":[186],"success":[188],"rate":[189],"attack":[192],"35.28%.":[194],"model":[196],"exhibits":[197],"good":[198,207],"robustness":[199,211],"against":[200],"adversarial":[201],"attacks.":[202],"proposed":[204],"performance,":[209],"enhanced":[210,234],"stability.":[213],"Applied":[214],"actual":[216],"devices":[218],"can":[219],"improve":[220],"security":[222],"privacy":[224],"protection":[225],"level":[226],"user":[228],"data.":[229],"ensures":[232],"efficiency":[235],"stability,":[237],"provides":[239],"certain":[241],"reference":[242],"direction":[243],"detection.":[247]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-04-24T00:00:00"}