{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,17]],"date-time":"2026-05-17T12:29:11Z","timestamp":1779020951047,"version":"3.51.4"},"reference-count":30,"publisher":"Wiley","issue":"12","license":[{"start":{"date-parts":[[2014,11,21]],"date-time":"2014-11-21T00:00:00Z","timestamp":1416528000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"funder":[{"name":"China 863 program","award":["2011AA01A205"],"award-info":[{"award-number":["2011AA01A205"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Security Comm Networks"],"published-print":{"date-parts":[[2015,8]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>With the rapid growth of Android applications and malware, it has become a challenge to distinguish malware from a huge number of applications. The use of behavioral analytics is one of the most promising approaches because of its accuracy and resilience to malware variants. In this paper, we propose a behavior\u2010based malware detection system. Firstly, it uses Android APIs and libc (Bionic libc) function calls along with their arguments to describe sensitive application behaviors. Secondly, it conducts behavior analysis and malware detection using machine learning techniques, including Support Vector Machine, Na\u00efve Bayes, and Decision Tree. The experiments are conducted with 1136 real\u2010world samples that are composed of various types of malware and benign applications. The evaluation results show that our system can effectively detect Android malware. In addition, we compare our system with the other behavior\u2010based malware detection system, and the comparison results show the advantage of our system on malware detection. Copyright \u00a9 2014 John Wiley &amp; Sons, Ltd.<\/jats:p>","DOI":"10.1002\/sec.1155","type":"journal-article","created":{"date-parts":[[2014,11,22]],"date-time":"2014-11-22T05:11:23Z","timestamp":1416633083000},"page":"2079-2089","source":"Crossref","is-referenced-by-count":12,"title":["An effective behavior\u2010based Android malware detection system"],"prefix":"10.1002","volume":"8","author":[{"given":"Shihong","family":"Zou","sequence":"first","affiliation":[{"name":"State Key Lab of Networking and Switching Beijing University of Posts and Telecommunications Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jing","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Lab of Networking and Switching Beijing University of Posts and Telecommunications Beijing China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaodong","family":"Lin","sequence":"additional","affiliation":[{"name":"University of Ontario Institute of Technology Canada"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"311","published-online":{"date-parts":[[2014,11,21]]},"reference":[{"key":"e_1_2_6_2_1","unstructured":"Kantar Worldpanel.Android ends the year on top but Apple scores in key markets. Available from:http:\/\/www.kantarworldpanel.com\/global\/News\/news\u2010articles\/Android\u2010ends\u2010the\u2010year\u2010on\u2010top\u2010but\u2010Apple\u2010scores\u2010in\u2010key\u2010markets\/[Accessed on 15 June 2014]."},{"key":"e_1_2_6_3_1","unstructured":"NQ Mobile.2013 Mid\u2010Year Mobile Security Report. Available from:http:\/\/blog.nq.com\/2013midyearsecurityreport\/[Accessed on 15 June 2014]."},{"key":"e_1_2_6_4_1","doi-asserted-by":"crossref","unstructured":"BlasingT BatyukL SchmidtAD CamtepeSA AlbayrakS.An android application sandbox system for suspicious software detection. In2010 5th International Conference on Malicious and Unwanted Software (MALWARE) IEEE:Nancy France 2010;55\u201362.","DOI":"10.1109\/MALWARE.2010.5665792"},{"key":"e_1_2_6_5_1","doi-asserted-by":"crossref","unstructured":"BurgueraI ZurutuzaU Nadjm\u2010TehraniS.Crowdroid: behavior\u2010based malware detection system for android. InProceedings of the 1st ACM Workshop on Security and Privacy in Smartphones and Mobile Devices ACM:Chicago Illinois USA 2011;15\u201326.","DOI":"10.1145\/2046614.2046619"},{"key":"e_1_2_6_6_1","doi-asserted-by":"crossref","unstructured":"IsoharaT TakemoriK KubotaA.Kernel\u2010based behavior analysis for android malware detection. In2011 Seventh International Conference on Computational Intelligence and Security (CIS) IEEE:Sanya Hainan China 2011;1011\u20131015.","DOI":"10.1109\/CIS.2011.226"},{"key":"e_1_2_6_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10844-010-0148-x"},{"key":"e_1_2_6_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33704-8_21"},{"key":"e_1_2_6_9_1","doi-asserted-by":"crossref","unstructured":"XieL ZhangX SeifertJP ZhuS.pBMDS: a behavior\u2010based malware detection system for cellphone devices. InProceedings of the Third ACM Conference on Wireless Network Security ACM:Hoboken New Jersey USA 2010;37\u201348.","DOI":"10.1145\/1741866.1741874"},{"key":"e_1_2_6_10_1","unstructured":"YuW ZhangH GeL HardyR.On behavior\u2010based detection of malware on android platform. InProc. of IEEE Globe Communication (GLOBECOM)\u2014Communication and Information System Security (CISS) Symposium:Atlanta Georgia USA 2013."},{"issue":"2","key":"e_1_2_6_11_1","first-page":"1","article-title":"An automated malware detection system for android using behavior\u2010based analysis AMDA","volume":"2","author":"Abela KJ","year":"2013","journal-title":"International Journal of Cyber\u2010Security and Digital Forensics (IJCSDF)"},{"key":"e_1_2_6_12_1","doi-asserted-by":"crossref","unstructured":"ZhangY YangM XuB et al.Vetting undesirable behaviors in android apps with permission use analysis. InProceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security ACM:Berlin Germany 2013;611\u2013622.","DOI":"10.1145\/2508859.2516689"},{"key":"e_1_2_6_13_1","unstructured":"Android Developers.JNI Tips. Available from:http:\/\/developer.android.com\/training\/articles\/perf\u2010jni.html[Accessed on 15 June 2014]."},{"key":"e_1_2_6_14_1","unstructured":"360.Oldboot: the first bootkit on Android. Available from:http:\/\/blogs.360.cn\/360mobile\/2014\/01\/17\/oldboot\u2010the\u2010first\u2010bootkit\u2010on\u2010android\/[Accessed on 15 June 2014]."},{"key":"e_1_2_6_15_1","unstructured":"STRACE. Available from:http:\/\/unixhelp.ed.ac.uk\/CGI\/man\u2010cgi?strace+1[Accessed on 15 June 2014]."},{"key":"e_1_2_6_16_1","unstructured":"ReinaA FattoriA CavallaroL.A system call\u2010centric analysis and stimulation technique to automatically reconstruct android malware behaviors. EuroSec April2013."},{"key":"e_1_2_6_17_1","unstructured":"Bionic vs Glibc report. Available from:http:\/\/irati.eu\/wp\u2010content\/uploads\/2012\/07\/bionic_report.pdf[Accessed on 15 June 2014]."},{"key":"e_1_2_6_18_1","doi-asserted-by":"crossref","unstructured":"BoserBE GuyonIM VapnikVN.A training algorithm for optimal margin classifiers. InProceedings of the Fifth Annual Workshop on Computational Learning Theory ACM:Pittsburgh Pennsylvania USA 1992;144\u2013152.","DOI":"10.1145\/130385.130401"},{"key":"e_1_2_6_19_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF00994018"},{"key":"e_1_2_6_20_1","unstructured":"McCallumA NigamK.A comparison of event models for naive bayes text classification. InAAAI\u201098 Workshop on Learning for Text Categorization 1998;752:41\u201348."},{"key":"e_1_2_6_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/21.97458"},{"key":"e_1_2_6_22_1","doi-asserted-by":"crossref","unstructured":"JunkerM HochR DengelA.On the evaluation of document analysis components by recall precision and accuracy. InProceedings of the Fifth International Conference on Document Analysis and Recognition (ICDAR'99) IEEE:Bangalore India 1999;713\u2013716.","DOI":"10.1109\/ICDAR.1999.791887"},{"key":"e_1_2_6_23_1","unstructured":"ANVA. Available from:http:\/\/www.anva.org.cn\/webInfo\/show\/1056[Accessed on 15 June 2014]."},{"key":"e_1_2_6_24_1","unstructured":"Android Architecture and Binder http:\/\/rts.lab.asu.edu\/web_438\/project_final\/Talk%208%20AndroidArc_Binder.pdf[Accessed on 15 June 2014]."},{"key":"e_1_2_6_25_1","unstructured":"Android Developers \u201cContent Providers\u201d. Available from:http:\/\/developer.android.com\/guide\/topics\/providers\/content\u2010providers.html[Accessed on 15 June 2014]."},{"key":"e_1_2_6_26_1","first-page":"514","article-title":"Feature weighted support vector machine","volume":"31","author":"Wang T","year":"2009","journal-title":"Journal of Electronics and Information Technology"},{"key":"e_1_2_6_27_1","doi-asserted-by":"crossref","unstructured":"XingHJ HaMH TianDZ HuBG.A novel support vector machine with its features weighted by mutual information. InIEEE International Joint Conference on Neural Networks IJCNN (IEEE World Congress on Computational Intelligence) IEEE:Hong Kong China 2008;315\u2013320.","DOI":"10.1109\/IJCNN.2008.4633810"},{"key":"e_1_2_6_28_1","unstructured":"Gini Criterion (CART algorithms). Available from:http:\/\/pic.dhe.ibm.com\/infocenter\/spssstat\/v20r0m0\/index.jsp?topic=%2Fcom.ibm.spss.statistics.help%2Falg_tree\u2010cart_split\u2010criteria_categorical_gini.htm[Accessed on 15 June 2014]."},{"key":"e_1_2_6_29_1","unstructured":"Android Malware Genome Project. Available from:http:\/\/www.malgenomeproject.org\/[Accessed on 15 June 2014]."},{"key":"e_1_2_6_30_1","unstructured":"NQ Mobile. Available from:http:\/\/en.nq.com\/[Accessed on 15 June 2014]."},{"key":"e_1_2_6_31_1","unstructured":"VirusTotal. Available from:https:\/\/www.virustotal.com\/[Accessed on 15 June 2014]."}],"container-title":["Security and Communication Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fsec.1155","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fsec.1155","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/sec.1155","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,5,13]],"date-time":"2025-05-13T20:33:05Z","timestamp":1747168385000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/sec.1155"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,11,21]]},"references-count":30,"journal-issue":{"issue":"12","published-print":{"date-parts":[[2015,8]]}},"alternative-id":["10.1002\/sec.1155"],"URL":"https:\/\/doi.org\/10.1002\/sec.1155","archive":["Portico"],"relation":{},"ISSN":["1939-0114","1939-0122"],"issn-type":[{"value":"1939-0114","type":"print"},{"value":"1939-0122","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,11,21]]}}}