The DOI matches its Crossref record; 35 of the 35 references it cites were found in a registry or an index.
Structural detection of android malware using embedded call graphs
Abstract
The number of malicious applications targeting the Android system has literally exploded in recent years. While the security community, well aware of this fact, has proposed several methods for detection of Android malware, most of these are based on permission and API usage or the identification of expert features. Unfortunately, many of these approaches are susceptible to instruction level obfuscation techniques. Previous research on classic desktop malware has shown that some high level characteristics of the code, such as function call graphs, can be used to find similarities between samples while being more robust against certain obfuscation strategies. However, the identification of similarities in graphs is a non-trivial problem whose complexity hinders the use of these features for malware detection. In this paper, we explore how recent developments in machine learning classification of graphs can be efficiently applied to this problem. We propose a method for malware detection based on efficient embeddings of function call graphs with an explicit feature map inspired by a linear-time graph kernel. In an evaluation with 12,158 malware samples our method, purely based on structural features, outperforms several related approaches and detects 89% of the malware with few false alarms, while also allowing to pin-point malicious code structures within Android applications.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
TaintDroid: an information-flow tracking system for realtime privacy monitoring on smartphones
Enck, W., Gilbert, P., Chun, B.-G., Cox, L. P., Jung, J., McDaniel, P. D., & Sheth, A. N. (2010) · doi:10.5555/1924943.1924971 · Cited by 2,238
Dissecting Android Malware: Characterization and Evolution
Zhou, Y., & Jiang, X. (2012) · 2012 IEEE Symposium on Security and Privacy · doi:10.1109/sp.2012.16 · Cited by 2,133
Android permissions demystified
Felt, A. P., Chin, E., Hanna, S., Song, D., & Wagner, D. (2011) · Proceedings of the 18th ACM conference on Computer and communications security · doi:10.1145/2046707.2046779 · Cited by 1,291
Protein function prediction via graph kernels
Borgwardt, K. M., Ong, C. S., Schonauer, S., Vishwanathan, S. V. N., Smola, A. J., & Kriegel, H.-P. (2005) · Bioinformatics · doi:10.1093/bioinformatics/bti1007 · Cited by 1,105
Convolution kernels on discrete structures
Haussler, D. H. (1999) · Cited by 1,089
On lightweight mobile phone application certification
Enck, W., Ongtang, M., & McDaniel, P. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653691 · Cited by 921
A study of android application security
Enck, W., Octeau, D., McDaniel, P. D., & Chaudhuri, S. (2011) · Cited by 871
A survey of mobile malware in the wild
Felt, A. P., Finifter, M., Chin, E., Hanna, S., & Wagner, D. (2011) · Proceedings of the 1st ACM workshop on Security and privacy in smartphones and mobile devices · doi:10.1145/2046614.2046618 · Cited by 768
Hey, You, Get Off of My Market: Detecting Malicious Apps in Official and Alternative Android Markets
Zhou, Y., Wang, Z., Zhou, W., & Jiang, X. (2012) · Network and Distributed System Security Symposium · Cited by 734
Diffusion Kernels on Graphs and Other Discrete Input Spaces
Kondor, R., & Lafferty, J. (2002) · Cited by 725
Cited by
Drebin: Effective and Explainable Detection of Android Malware in Your Pocket
Arp, D., Spreitzenbarth, M., Hübner, M., Gascon, H., & Rieck, K. (2014) · Proceedings 2014 Network and Distributed System Security Symposium · doi:10.14722/ndss.2014.23247 · Cited by 2,331
Self-citationApposcopy: semantics-based detection of Android malware through static analysis
Feng, Y., Anand, S., Dillig, I., & Aiken, A. (2014) · Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering · doi:10.1145/2635868.2635869 · Cited by 437
MADAM: Effective and Efficient Behavior-based Android Malware Detection and Prevention
Saracino, A., Sgandurra, D., Dini, G., & Martinelli, F. (2018) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2016.2536605 · Cited by 434
Onwuzurike, L., Mariconti, E., Andriotis, P., Cristofaro, E. D., Ross, G., & Stringhini, G. (2019) · ACM Transactions on Privacy and Security · doi:10.1145/3313391 · Cited by 334
Android HIV: A Study of Repackaging Malware for Evading Machine-Learning Detection
Chen, X., Li, C., Wang, D., Wen, S., Zhang, J., Nepal, S., Xiang, Y., & Ren, K. (2020) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2019.2932228 · Cited by 328
Metadata
- Authors
- Gascon, H., Yamaguchi, F., Arp, D., & Rieck, K.
- Venue
- Proceedings of the 2013 ACM workshop on Artificial intelligence and security
- Publisher
- ACM
- Published
- 2013-11-04
- Pages
- 45-54
- OpenAlex
- W2092942461
- Cited by
- 329
- References
- 35
- FWCI
- 18.64
- Type
- conference paper
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Structural detection of android malware using embedded call graphs. https://app.cochat.ai/papers/10.1145/2517312.2517315
- The paper
- Gascon, H., Yamaguchi, F., Arp, D., & Rieck, K. (2013). Structural detection of android malware using embedded call graphs. Proceedings of the 2013 ACM workshop on Artificial intelligence and security. https://doi.org/10.1145/2517312.2517315
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
