{"id":"https://openalex.org/W4416994893","doi":"https://doi.org/10.3390/jcp5040109","title":"MalVis: Large-Scale Bytecode Visualization Framework for Explainable Android Malware Detection","display_name":"MalVis: Large-Scale Bytecode Visualization Framework for Explainable Android Malware Detection","publication_year":2025,"publication_date":"2025-12-04","ids":{"openalex":"https://openalex.org/W4416994893","doi":"https://doi.org/10.3390/jcp5040109"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5040109","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040109","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/jcp5040109","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5106638539","display_name":"Saleh J. Makkawy","orcid":"https://orcid.org/0009-0006-3437-335X"},"institutions":[{"id":"https://openalex.org/I199693650","display_name":"Umm al-Qura University","ror":"https://ror.org/01xjqrm90","country_code":"SA","type":"education","lineage":["https://openalex.org/I199693650"]},{"id":"https://openalex.org/I86501945","display_name":"University of Delaware","ror":"https://ror.org/01sbq1a82","country_code":"US","type":"education","lineage":["https://openalex.org/I86501945"]}],"countries":["SA","US"],"is_corresponding":true,"raw_author_name":"Saleh J. Makkawy","raw_affiliation_strings":["Department of Computer Science, Umm Al Qura University, Mecca 21955, Saudi Arabia","Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA"],"raw_orcid":"https://orcid.org/0009-0006-3437-335X","affiliations":[{"raw_affiliation_string":"Department of Computer Science, Umm Al Qura University, Mecca 21955, Saudi Arabia","institution_ids":["https://openalex.org/I199693650"]},{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA","institution_ids":["https://openalex.org/I86501945"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049055215","display_name":"Michael J. De Lucia","orcid":null},"institutions":[{"id":"https://openalex.org/I86501945","display_name":"University of Delaware","ror":"https://ror.org/01sbq1a82","country_code":"US","type":"education","lineage":["https://openalex.org/I86501945"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael J. De Lucia","raw_affiliation_strings":["Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA","institution_ids":["https://openalex.org/I86501945"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5036946701","display_name":"Kenneth E. Barner","orcid":"https://orcid.org/0000-0002-0936-7840"},"institutions":[{"id":"https://openalex.org/I86501945","display_name":"University of Delaware","ror":"https://ror.org/01sbq1a82","country_code":"US","type":"education","lineage":["https://openalex.org/I86501945"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kenneth E. Barner","raw_affiliation_strings":["Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA"],"raw_orcid":"https://orcid.org/0000-0002-0936-7840","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, University of Delaware, Newark, DE 19711, USA","institution_ids":["https://openalex.org/I86501945"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5106638539"],"corresponding_institution_ids":["https://openalex.org/I199693650","https://openalex.org/I86501945"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.5535,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.70760396,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":95},"biblio":{"volume":"5","issue":"4","first_page":"109","last_page":"109"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9937000274658203,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.0008999999845400453,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7346000075340271},{"id":"https://openalex.org/keywords/visualization","display_name":"Visualization","score":0.682200014591217},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.6256999969482422},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.5085999965667725},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4081999957561493},{"id":"https://openalex.org/keywords/data-visualization","display_name":"Data visualization","score":0.3865000009536743},{"id":"https://openalex.org/keywords/glyph","display_name":"Glyph (data visualization)","score":0.3833000063896179},{"id":"https://openalex.org/keywords/creative-visualization","display_name":"Creative visualization","score":0.38019999861717224}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8507999777793884},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7346000075340271},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.682200014591217},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.6256999969482422},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.5085999965667725},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4465000033378601},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42170000076293945},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4081999957561493},{"id":"https://openalex.org/C172367668","wikidata":"https://www.wikidata.org/wiki/Q6504956","display_name":"Data visualization","level":3,"score":0.3865000009536743},{"id":"https://openalex.org/C142816647","wikidata":"https://www.wikidata.org/wiki/Q5573018","display_name":"Glyph (data visualization)","level":3,"score":0.3833000063896179},{"id":"https://openalex.org/C14669888","wikidata":"https://www.wikidata.org/wiki/Q4014850","display_name":"Creative visualization","level":3,"score":0.38019999861717224},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.36340001225471497},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.3628999888896942},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.3617999851703644},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.35830000042915344},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.3571999967098236},{"id":"https://openalex.org/C136536468","wikidata":"https://www.wikidata.org/wiki/Q1225894","display_name":"Undersampling","level":2,"score":0.2955999970436096},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.29429998993873596},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2660999894142151},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.2578999996185303},{"id":"https://openalex.org/C187191949","wikidata":"https://www.wikidata.org/wiki/Q1138496","display_name":"Profiling (computer programming)","level":2,"score":0.25699999928474426},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.25699999928474426},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.2533000111579895}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5040109","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040109","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:83e04c9479ff4940a69d1dd8e75295be","is_oa":true,"landing_page_url":"https://doaj.org/article/83e04c9479ff4940a69d1dd8e75295be","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 4, p 109 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5040109","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040109","pdf_url":null,"source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":51,"referenced_works":["https://openalex.org/W1512933114","https://openalex.org/W1978136502","https://openalex.org/W2006071261","https://openalex.org/W2010065958","https://openalex.org/W2012132268","https://openalex.org/W2046185165","https://openalex.org/W2122672392","https://openalex.org/W2148143831","https://openalex.org/W2154874878","https://openalex.org/W2186054980","https://openalex.org/W2395100307","https://openalex.org/W2407313496","https://openalex.org/W2625739732","https://openalex.org/W2765271136","https://openalex.org/W2765793020","https://openalex.org/W2772832743","https://openalex.org/W2795033129","https://openalex.org/W2962858109","https://openalex.org/W2972262359","https://openalex.org/W2982912425","https://openalex.org/W2990518194","https://openalex.org/W2996367417","https://openalex.org/W3007844610","https://openalex.org/W3017679144","https://openalex.org/W3021503072","https://openalex.org/W3036603968","https://openalex.org/W3038549562","https://openalex.org/W3095563611","https://openalex.org/W3129282298","https://openalex.org/W3131606647","https://openalex.org/W3164259157","https://openalex.org/W3167400801","https://openalex.org/W3195279647","https://openalex.org/W3201749075","https://openalex.org/W3212172514","https://openalex.org/W4205521168","https://openalex.org/W4206339044","https://openalex.org/W4221098431","https://openalex.org/W4296959840","https://openalex.org/W4306316917","https://openalex.org/W4381736097","https://openalex.org/W4382240482","https://openalex.org/W4385627058","https://openalex.org/W4391883773","https://openalex.org/W4394896998","https://openalex.org/W4394994509","https://openalex.org/W4400975448","https://openalex.org/W4401751564","https://openalex.org/W4408343759","https://openalex.org/W4409233689","https://openalex.org/W4411055052"],"related_works":[],"abstract_inverted_index":{"As":[0],"technology":[1],"advances,":[2],"developers":[3,71],"continually":[4],"create":[5],"innovative":[6],"solutions":[7],"to":[8,22,42,87,110,248],"enhance":[9],"smartphone":[10],"security.":[11],"However,":[12],"the":[13,90,119,160,219,233,240,287],"rapid":[14],"spread":[15],"of":[16,94,126,221,235,255,289],"Android":[17,28],"malware":[18,47,78,120,181,299],"poses":[19],"significant":[20,124],"threats":[21],"devices":[23],"and":[24,34,54,66,107,114,140,152,183,209,216,275,294,301,308],"sensitive":[25],"data.":[26],"The":[27,157],"Operating":[29,278],"System":[30],"(OS)\u2019s":[31],"open-source":[32],"nature":[33],"Software":[35],"Development":[36],"Kit":[37],"(SDK)":[38],"availability":[39],"mainly":[40],"contribute":[41],"this":[43,165],"alarming":[44],"growth.":[45],"Conventional":[46],"detection":[48,79,147,300],"methods,":[49,129],"such":[50,130],"as":[51,131],"signature-based,":[52],"static,":[53],"dynamic":[55],"analysis,":[56],"face":[57],"challenges":[58],"in":[59,68,164,179,239,291],"detecting":[60],"obfuscated":[61,151],"techniques,":[62],"including":[63],"encryption,":[64],"packing,":[65],"compression,":[67],"malware.":[69,95,156,256],"Although":[70],"have":[72],"created":[73],"several":[74],"visualization":[75,102,128,196],"techniques":[76,197],"for":[77,150,298,306],"using":[80,198,226],"deep":[81],"learning":[82,251],"(DL),":[83],"they":[84],"often":[85],"fail":[86],"accurately":[88],"identify":[89],"critical":[91],"malicious":[92],"features":[93,297],"This":[96],"research":[97,307],"introduces":[98],"MalVis,":[99],"a":[100,167],"unified":[101],"framework":[103,158],"that":[104],"integrates":[105],"entropy":[106],"N-gram":[108],"analysis":[109],"emphasize":[111],"meaningful":[112],"structural":[113],"anomalous":[115],"operational":[116],"patterns":[117],"within":[118],"bytecode.":[121],"By":[122],"addressing":[123],"limitations":[125],"existing":[127,194],"insufficient":[132],"feature":[133],"representation,":[134],"limited":[135],"interpretability,":[136],"small":[137],"dataset":[138,162,171],"sizes,":[139],"restricted":[141],"data":[142],"access,":[143],"MalVis":[144,161,257,290],"delivers":[145],"enhanced":[146],"capabilities,":[148],"particularly":[149],"previously":[153],"unseen":[154],"(zero-day)":[155],"leverages":[159],"introduced":[163],"work,":[166],"publicly":[168],"available":[169],"large-scale":[170],"comprising":[172],"more":[173],"than":[174],"1.3":[175],"million":[176],"visual":[177],"representations":[178],"nine":[180],"classes":[182],"one":[184],"benign":[185],"class.":[186],"A":[187],"comprehensive":[188],"comparative":[189],"evaluation":[190],"was":[191],"performed":[192],"against":[193],"state-of-the-art":[195],"leading":[199],"convolutional":[200],"neural":[201],"network":[202],"(CNN)":[203],"architectures,":[204],"MobileNet-V2,":[205],"DenseNet201,":[206],"ResNet50,":[207],"VGG16,":[208],"Inception-V3.":[210],"To":[211,231],"further":[212],"boost":[213],"classification":[214],"performance":[215],"mitigate":[217],"overfitting,":[218],"outputs":[220],"these":[222],"models":[223],"were":[224],"combined":[225],"eight":[227],"distinct":[228],"ensemble":[229],"strategies.":[230],"address":[232],"issue":[234],"imbalanced":[236],"class":[237],"distribution":[238],"multiclass":[241],"dataset,":[242],"we":[243],"employed":[244],"an":[245],"undersampling":[246],"technique":[247],"ensure":[249],"balanced":[250],"across":[252],"all":[253],"types":[254],"achieved":[258],"superior":[259],"results,":[260],"with":[261],"95%":[262],"accuracy,":[263],"90%":[264],"F1-score,":[265],"92%":[266],"precision,":[267],"89%":[268],"recall,":[269],"87%":[270],"Matthews":[271],"Correlation":[272],"Coefficient":[273],"(MCC),":[274],"98%":[276],"Receiver":[277],"Characteristic":[279],"Area":[280],"Under":[281],"Curve":[282],"(ROC-AUC).":[283],"These":[284],"findings":[285],"highlight":[286],"effectiveness":[288],"providing":[292],"interpretable":[293],"accurate":[295],"representation":[296],"classification,":[302],"making":[303],"it":[304],"valuable":[305],"real-world":[309],"security":[310],"applications.":[311]},"counts_by_year":[{"year":2025,"cited_by_count":1}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-12-04T00:00:00"}