{"id":"https://openalex.org/W3187102702","doi":"https://doi.org/10.3390/e23081009","title":"A Hybrid Analysis-Based Approach to Android Malware Family Classification","display_name":"A Hybrid Analysis-Based Approach to Android Malware Family Classification","publication_year":2021,"publication_date":"2021-08-03","ids":{"openalex":"https://openalex.org/W3187102702","doi":"https://doi.org/10.3390/e23081009","mag":"3187102702","pmid":"https://pubmed.ncbi.nlm.nih.gov/34441149"},"language":"en","primary_location":{"id":"doi:10.3390/e23081009","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23081009","pdf_url":"https://www.mdpi.com/1099-4300/23/8/1009/pdf","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1099-4300/23/8/1009/pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018268258","display_name":"Chao Ding","orcid":"https://orcid.org/0000-0001-6008-7863"},"institutions":[{"id":"https://openalex.org/I96908189","display_name":"Xinjiang University","ror":"https://ror.org/059gw8r13","country_code":"CN","type":"education","lineage":["https://openalex.org/I96908189"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chao Ding","raw_affiliation_strings":["College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"],"raw_orcid":"https://orcid.org/0000-0001-6008-7863","affiliations":[{"raw_affiliation_string":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China","institution_ids":["https://openalex.org/I96908189"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073536083","display_name":"Nurbol Luktarhan","orcid":"https://orcid.org/0000-0002-4043-6920"},"institutions":[{"id":"https://openalex.org/I96908189","display_name":"Xinjiang University","ror":"https://ror.org/059gw8r13","country_code":"CN","type":"education","lineage":["https://openalex.org/I96908189"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Nurbol Luktarhan","raw_affiliation_strings":["College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China","institution_ids":["https://openalex.org/I96908189"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5074318342","display_name":"Bei Lu","orcid":"https://orcid.org/0000-0002-0351-5814"},"institutions":[{"id":"https://openalex.org/I96908189","display_name":"Xinjiang University","ror":"https://ror.org/059gw8r13","country_code":"CN","type":"education","lineage":["https://openalex.org/I96908189"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bei Lu","raw_affiliation_strings":["College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China","institution_ids":["https://openalex.org/I96908189"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5010417031","display_name":"Wenhui Zhang","orcid":"https://orcid.org/0000-0001-6477-7781"},"institutions":[{"id":"https://openalex.org/I96908189","display_name":"Xinjiang University","ror":"https://ror.org/059gw8r13","country_code":"CN","type":"education","lineage":["https://openalex.org/I96908189"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenhui Zhang","raw_affiliation_strings":["College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China"],"raw_orcid":"https://orcid.org/0000-0001-6477-7781","affiliations":[{"raw_affiliation_string":"College of Information Science and Engineering, Xinjiang University, Urumqi 830046, China","institution_ids":["https://openalex.org/I96908189"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5073536083"],"corresponding_institution_ids":["https://openalex.org/I96908189"],"apc_list":{"value":2000,"currency":"CHF","value_usd":2227},"apc_paid":{"value":2000,"currency":"CHF","value_usd":2227},"fwci":4.7344,"has_fulltext":false,"cited_by_count":50,"citation_normalized_percentile":{"value":0.95812031,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"23","issue":"8","first_page":"1009","last_page":"1009"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8803867101669312},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8212564587593079},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.7414127588272095},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.6771742701530457},{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.6171938180923462},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6122408509254456},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.5867869257926941},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4988698959350586},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.42996153235435486},{"id":"https://openalex.org/keywords/traffic-classification","display_name":"Traffic classification","score":0.4170992076396942},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4084421992301941},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.1484549343585968},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.13577929139137268},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.0976940393447876}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8803867101669312},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8212564587593079},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.7414127588272095},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.6771742701530457},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.6171938180923462},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6122408509254456},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.5867869257926941},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4988698959350586},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42996153235435486},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.4170992076396942},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4084421992301941},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.1484549343585968},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.13577929139137268},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0976940393447876},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":5,"locations":[{"id":"doi:10.3390/e23081009","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23081009","pdf_url":"https://www.mdpi.com/1099-4300/23/8/1009/pdf","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},{"id":"pmid:34441149","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/34441149","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy (Basel, Switzerland)","raw_type":null},{"id":"pmh:oai:doaj.org/article:8481c47205c0467d9a9328fa762bffc4","is_oa":true,"landing_page_url":"https://doaj.org/article/8481c47205c0467d9a9328fa762bffc4","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy, Vol 23, Iss 8, p 1009 (2021)","raw_type":"article"},{"id":"pmh:oai:mdpi.com:/1099-4300/23/8/1009/","is_oa":true,"landing_page_url":"https://dx.doi.org/10.3390/e23081009","pdf_url":null,"source":{"id":"https://openalex.org/S4306400947","display_name":"MDPI (MDPI AG)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210097602","host_organization_name":"Multidisciplinary Digital Publishing Institute (Switzerland)","host_organization_lineage":["https://openalex.org/I4210097602"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy; Volume 23; Issue 8; Pages: 1009","raw_type":"Text"},{"id":"pmh:oai:pubmedcentral.nih.gov:8394521","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/8394521","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Entropy (Basel)","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.3390/e23081009","is_oa":true,"landing_page_url":"https://doi.org/10.3390/e23081009","pdf_url":"https://www.mdpi.com/1099-4300/23/8/1009/pdf","source":{"id":"https://openalex.org/S195231649","display_name":"Entropy","issn_l":"1099-4300","issn":["1099-4300"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Entropy","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/15","score":0.47999998927116394,"display_name":"Life in Land"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W3187102702.pdf"},"referenced_works_count":29,"referenced_works":["https://openalex.org/W46659105","https://openalex.org/W1932847118","https://openalex.org/W2015817790","https://openalex.org/W2059043756","https://openalex.org/W2064675550","https://openalex.org/W2095705004","https://openalex.org/W2101234009","https://openalex.org/W2107878631","https://openalex.org/W2149600645","https://openalex.org/W2194775991","https://openalex.org/W2606697812","https://openalex.org/W2782729947","https://openalex.org/W2906631928","https://openalex.org/W2963516518","https://openalex.org/W2982413766","https://openalex.org/W2998216295","https://openalex.org/W3005124797","https://openalex.org/W3008764821","https://openalex.org/W3031467800","https://openalex.org/W3038058348","https://openalex.org/W3040974506","https://openalex.org/W3044817893","https://openalex.org/W3129906305","https://openalex.org/W3138102940","https://openalex.org/W3147879240","https://openalex.org/W4285719527","https://openalex.org/W6674330103","https://openalex.org/W6675354045","https://openalex.org/W7066667914"],"related_works":["https://openalex.org/W2560361988","https://openalex.org/W2507113366","https://openalex.org/W2610659201","https://openalex.org/W2591124010","https://openalex.org/W3200508744","https://openalex.org/W3025122950","https://openalex.org/W2717179875","https://openalex.org/W4249118297","https://openalex.org/W2791662519","https://openalex.org/W3036603968"],"abstract_inverted_index":{"With":[0],"the":[1,96,105,109,120,140,186,194,219,236,241],"popularity":[2],"of":[3,79,102,132,158,222,240,245],"Android,":[4],"malware":[5,41,44,224],"detection":[6,100,220],"and":[7,27,42,51,64,69,90,160,165,173,188,212,243],"family":[8,225],"classification":[9,226],"have":[10,19],"also":[11,217],"become":[12],"a":[13,77,99,130,143,155],"research":[14],"focus.":[15],"Many":[16],"excellent":[17],"methods":[18,74],"been":[20],"proposed":[21],"by":[22],"previous":[23,230],"authors,":[24],"but":[25,216],"static":[26,59,67,122,195,210],"dynamic":[28,144],"analyses":[29],"inevitably":[30],"require":[31],"complex":[32],"processes.":[33],"A":[34],"hybrid":[35],"analysis":[36,145],"method":[37],"for":[38,55],"detecting":[39],"Android":[40,223],"classifying":[43],"families":[45],"is":[46,52,95,108,180],"presented":[47],"in":[48,125,193,229,238],"this":[49,126],"paper,":[50],"partially":[53,189],"optimized":[54],"multiple-feature":[56],"data.":[57],"For":[58],"analysis,":[60],"we":[61,128,169],"use":[62,70],"permissions":[63],"intent":[65],"as":[66],"features":[68,123,134,211],"three":[71,80],"feature":[72,111,116],"selection":[73,112,117],"to":[75,118,135,183,232],"form":[76],"subset":[78,131],"candidate":[81],"features.":[82],"Compared":[83],"with":[84,98,208],"various":[85],"models,":[86],"including":[87],"k-nearest":[88],"neighbors":[89],"random":[91,93],"forest,":[92],"forest":[94],"best,":[97],"rate":[101,221],"95.04%,":[103],"while":[104],"chi-square":[106],"test":[107],"best":[110],"method.":[113],"After":[114],"using":[115],"explore":[119],"critical":[121],"contained":[124],"dataset,":[127],"analyzed":[129],"important":[133],"gain":[136],"more":[137],"insight":[138],"into":[139],"malware.":[141],"In":[142],"based":[146],"on":[147,154,162,171],"network":[148],"traffic,":[149],"unlike":[150],"those":[151],"that":[152,201],"focus":[153],"one-way":[156],"flow":[157],"traffic":[159,237],"work":[161,207,231],"HTTP":[163],"protocols":[164,244],"transport":[166],"layer":[167],"protocols,":[168],"focused":[170],"sessions":[172,242],"retained":[174],"protocol":[175],"layers.":[176,247],"The":[177,197],"Res7LSTM":[178],"model":[179],"then":[181],"used":[182],"further":[184],"classify":[185],"malicious":[187],"benign":[190],"samples":[191],"detected":[192],"detection.":[196],"experimental":[198],"results":[199],"show":[200],"our":[202],"approach":[203],"can":[204],"not":[205],"only":[206],"fewer":[209],"guarantee":[213],"sufficient":[214],"accuracy,":[215],"improve":[218],"from":[227],"71.48%":[228],"99%":[233],"when":[234],"cutting":[235],"terms":[239],"all":[246]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":13},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":13},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-10T00:00:00"}