{"id":"https://openalex.org/W7159676853","doi":"https://doi.org/10.48550/arxiv.2604.27302","title":"Static Attribution of Android Residential Proxy Malware Using Graph Kernels","display_name":"Static Attribution of Android Residential Proxy Malware Using Graph Kernels","publication_year":2026,"publication_date":"2026-04-30","ids":{"openalex":"https://openalex.org/W7159676853","doi":"https://doi.org/10.48550/arxiv.2604.27302"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.27302","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27302","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.27302","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134961328","display_name":"Peter Clark","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Clark, Peter","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087366755","display_name":"Yong Guan","orcid":"https://orcid.org/0000-0002-2373-2779"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guan, Yong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5012464997","display_name":"Zhonghao Liao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liao, Zhonghao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.006599999964237213,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.00570000009611249,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/geolocation","display_name":"Geolocation","score":0.503000020980835},{"id":"https://openalex.org/keywords/proxy","display_name":"Proxy (statistics)","score":0.4902999997138977},{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.4887000024318695},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.43230000138282776},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.38089999556541443},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.36149999499320984},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.36149999499320984},{"id":"https://openalex.org/keywords/bytecode","display_name":"Bytecode","score":0.35600000619888306},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.35499998927116394}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7789999842643738},{"id":"https://openalex.org/C22041718","wikidata":"https://www.wikidata.org/wiki/Q638949","display_name":"Geolocation","level":2,"score":0.503000020980835},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.4902999997138977},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.4887000024318695},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.43230000138282776},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.38089999556541443},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3634999990463257},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C2779818221","wikidata":"https://www.wikidata.org/wiki/Q837330","display_name":"Bytecode","level":3,"score":0.35600000619888306},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.35499998927116394},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3529999852180481},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.32190001010894775},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3109999895095825},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.30889999866485596},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.3052000105381012},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.2946999967098236},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.2937000095844269},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.28780001401901245},{"id":"https://openalex.org/C2777810591","wikidata":"https://www.wikidata.org/wiki/Q16861606","display_name":"Credential","level":2,"score":0.2858999967575073},{"id":"https://openalex.org/C2988045736","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android app","level":3,"score":0.2754000127315521},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27459999918937683},{"id":"https://openalex.org/C102379954","wikidata":"https://www.wikidata.org/wiki/Q2589940","display_name":"Call graph","level":2,"score":0.2741999924182892},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.27309998869895935},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.2718000113964081},{"id":"https://openalex.org/C166955791","wikidata":"https://www.wikidata.org/wiki/Q629579","display_name":"Macro","level":2,"score":0.2662000060081482},{"id":"https://openalex.org/C115168132","wikidata":"https://www.wikidata.org/wiki/Q55813","display_name":"Machine code","level":3,"score":0.2635999917984009},{"id":"https://openalex.org/C18007350","wikidata":"https://www.wikidata.org/wiki/Q7394815","display_name":"STRIDE","level":2,"score":0.2567000091075897},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.2522999942302704}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.27302","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27302","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.27302","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.27302","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities","score":0.6393753886222839}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Android":[0,82],"residential":[1],"proxy":[2,41,54,83,88,178,206],"applications":[3,169,194],"represent":[4],"a":[5,39,58,77,116],"growing":[6],"class":[7],"of":[8,27,80,119,155,168,183],"potentially-unwanted":[9],"programs":[10],"(PUPs)":[11],"that":[12,161,187],"covertly":[13],"route":[14],"third-party":[15],"traffic":[16],"through":[17,173],"end-user":[18],"devices,":[19],"enabling":[20],"ad":[21],"fraud,":[22],"credential":[23],"abuse,":[24],"and":[25,51,70,73,97,201,208],"evasion":[26],"geolocation":[28],"controls":[29],"by":[30],"sophisticated":[31],"threat":[32],"actors.":[33],"Attributing":[34],"an":[35],"unknown":[36],"APK":[37],"to":[38,46,110,132,141],"specific":[40],"network":[42],"remains":[43],"challenging":[44],"due":[45],"code":[47],"reuse,":[48],"SDK":[49,179],"embedding,":[50],"obfuscation":[52],"across":[53,103],"families.":[55],"We":[56,90,159],"present":[57],"static-analysis":[59],"pipeline":[60],"for":[61,192],"automated":[62],"proxyware":[63],"family":[64],"attribution,":[65],"extracting":[66],"graph-structured":[67],"representations":[68],"(control-flow":[69],"function-call":[71],"graphs)":[72],"behavioral":[74],"signatures":[75],"from":[76,162],"labeled":[78],"corpus":[79],"3,365":[81],"apps":[84],"spanning":[85],"four":[86],"commercial":[87,203],"networks.":[89],"evaluate":[91],"Weisfeiler-Lehman":[92],"graph":[93],"kernel":[94],"features":[95],"alone":[96],"fused":[98],"with":[99],"binary":[100],"capability":[101],"vectors":[102],"multiple":[104],"classifiers.":[105],"Using":[106],"5-fold":[107],"DEX-grouped":[108],"cross-validation":[109],"prevent":[111],"data":[112],"leakage,":[113],"SGD":[114],"achieves":[115],"macro":[117],"F1":[118],"0.985":[120],"on":[121],"the":[122,153,156,163,166],"expanded":[123,164],"dataset.":[124],"To":[125],"support":[126],"explainability,":[127],"we":[128,148],"map":[129],"classifier":[130],"decisions":[131],"automatically":[133],"generated":[134],"Yara":[135],"rules,":[136],"achieving":[137],"per-family":[138],"accuracies":[139],"up":[140],"88.45\\%":[142],"after":[143],"filtering":[144],"non-discriminative":[145],"signatures.":[146],"Finally,":[147],"discuss":[149],"these":[150],"results":[151],"in":[152],"context":[154],"broader":[157],"ecosystem.":[158],"find":[160],"dataset,":[165],"majority":[167],"(51.4\\%)":[170],"still":[171,175],"available":[172],"APKPure":[174],"contain":[176],"embedded":[177],"code.":[180],"Further":[181],"analysis":[182],"developer":[184],"accounts":[185],"reveals":[186],"23":[188],"developers":[189],"are":[190],"responsible":[191],"other":[193],"also":[195],"containing":[196],"such":[197],"functionality,":[198],"suggesting":[199],"continuous":[200],"ongoing":[202],"relationships":[204],"between":[205],"providers":[207],"developers.":[209]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-02T00:00:00"}