From Signals to Behaviors: Evidence-Based Android Malware Detection

arXiv:2607.23272 · cs.CR, cs.SE · Submitted 2026-07-25 · Read on arXiv

Shiwen Song, Yiheng Xiong, Sen Chen, Xiaofei Xie

cs.CR, cs.SE

Submitted: 2026-07-25

Comments: 12 pages, 6 figures

Code: https://github.com/nationalsecurityagency/ghidra

Project page: https://muha2xmad.github.io/malware-analysis/irata

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Ablation — 6× in this paper · explained in 1 episode
Verification — 6× in this paper · explained in 2 episodes
Grounding — 5× in this paper · explained in 3 episodes
Knowledge Graph — 4× in this paper · explained in 7 episodes
Robustness — 4× in this paper · explained in 5 episodes
Ablation Studies — 2× in this paper · explained in 1 episode
Ablation study — 2× in this paper · explained in 1 episode
Concept Drift — 2× in this paper · explained in 4 episodes
Embeddings — 2× in this paper · explained in 2 episodes
Trace — 2× in this paper · explained in 2 episodes
Transactions on Software Engineering and Methodology — 2× in this paper
Accuracy — 1× in this paper · explained in 1 episode
Annotator Agreement — 1× in this paper · explained in 1 episode
Contrastive Learning — 1× in this paper · explained in 5 episodes
Core — 1× in this paper · explained in 2 episodes
Cosine Similarity — 1× in this paper · explained in 3 episodes
Decode — 1× in this paper · explained in 2 episodes
Explainability — 1× in this paper · explained in 3 episodes
F1 Score — 1× in this paper · explained in 3 episodes
Fingerprinting — 1× in this paper · explained in 2 episodes
Foundation Model — 1× in this paper · explained in 3 episodes
Foundation Models — 1× in this paper · explained in 7 episodes
Prompt Engineering — 1× in this paper · explained in 4 episodes
Representation Learning — 1× in this paper · explained in 2 episodes
SIGSAC Conference on Computer and Communications Security — 1× in this paper
Semantic Similarity — 1× in this paper · explained in 2 episodes

Terminology

Related papers