{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T23:39:00Z","timestamp":1768865940645,"version":"3.49.0"},"reference-count":43,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T00:00:00Z","timestamp":1762819200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T00:00:00Z","timestamp":1762819200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Autom Softw Eng"],"published-print":{"date-parts":[[2026,5]]},"DOI":"10.1007\/s10515-025-00575-9","type":"journal-article","created":{"date-parts":[[2025,11,11]],"date-time":"2025-11-11T03:12:33Z","timestamp":1762830753000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["The arts and crafts of android adware across a decade"],"prefix":"10.1007","volume":"33","author":[{"given":"Chao","family":"Wang","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianming","family":"Liu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yanjie","family":"Zhao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lin","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiaoning","family":"Du","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Li","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,11,11]]},"reference":[{"key":"575_CR1","doi-asserted-by":"publisher","first-page":"102718","DOI":"10.1016\/j.cose.2022.102718","volume":"117","author":"MM Alani","year":"2022","unstructured":"Alani, M.M., Awad, A.I.: Adstop: Efficient flow-based mobile adware detection using machine learning. Comput. Secur. 117, 102718 (2022)","journal-title":"Comput. Secur."},{"key":"575_CR2","unstructured":"Apktool. (2023). https:\/\/github.com\/iBotPeaches\/Apktool"},{"key":"575_CR3","doi-asserted-by":"crossref","unstructured":"Arp, D., Spreitzenbarth, M., Hubner, M., Gascon, H., Rieck, K., Siemens, C.: Drebin: Effective and explainable detection of android malware in your pocket. In: Ndss, vol. 14, pp. 23\u201326 (2014)","DOI":"10.14722\/ndss.2014.23247"},{"issue":"3","key":"575_CR4","first-page":"1378","volume":"18","author":"C Bai","year":"2019","unstructured":"Bai, C., Han, Q., Mezzour, G., Pierazzi, F., Subrahmanian, V.: Dbank: Predictive behavioral analysis of recent android banking trojans. IEEE Trans. Dependable Secure Comput. 18(3), 1378\u20131393 (2019)","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"575_CR5","doi-asserted-by":"crossref","unstructured":"Cao, M., Ahmed, K., Rubin, J.: Rotten apples spoil the bunch: An anatomy of google play malware. In: Proceedings of the 44th International Conference on Software Engineering, pp. 1919\u20131931 (2022)","DOI":"10.1145\/3510003.3510161"},{"key":"575_CR6","doi-asserted-by":"crossref","unstructured":"Chen, K., Wang, X., Chen, Y., Wang, P., Lee, Y., Wang, X., Ma, B., Wang, A., Zhang, Y., Zou, W.: Following devil\u2019s footprints: Cross-platform analysis of potentially harmful libraries on android and ios. In: 2016 IEEE Symposium on Security and Privacy (SP), pp. 357\u2013376. IEEE (2016)","DOI":"10.1109\/SP.2016.29"},{"issue":"5","key":"575_CR7","doi-asserted-by":"publisher","first-page":"1286","DOI":"10.1109\/TIFS.2017.2787905","volume":"13","author":"J Chen","year":"2017","unstructured":"Chen, J., Wang, C., Zhao, Z., Chen, K., Du, R., Ahn, G.-J.: Uncovering the face of android ransomware: Characterization and real-time detection. IEEE Trans. Inf. Forensics Secur. 13(5), 1286\u20131300 (2017)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"575_CR8","doi-asserted-by":"crossref","unstructured":"Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., McDaniel, P.: Flowdroid: Precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. ACM sigplan notices 49(6), 259\u2013269 (2014)","DOI":"10.1145\/2666356.2594299"},{"key":"575_CR9","doi-asserted-by":"crossref","unstructured":"Gao, J., Li, L., Kong, P., Bissyand\u00e9, T.F., Klein, J.: Should you consider adware as malware in your study? In: 2019 IEEE 26th International Conference on Software Analysis, Evolution and Reengineering (SANER), pp. 604\u2013608. IEEE (2019)","DOI":"10.1109\/SANER.2019.8668010"},{"key":"575_CR10","unstructured":"Gartner Magic Quadrant for Endpoint Protection Platforms. (2021). https:\/\/www.gartner.com\/en\/documents\/4001307"},{"key":"575_CR11","doi-asserted-by":"crossref","unstructured":"Hurier, M., Suarez-Tangil, G., Dash, S.K., Bissyand\u00e9, T.F., Le\u00a0Traon, Y., Klein, J., Cavallaro, L.: Euphony: Harmonious unification of cacophonous anti-virus vendor labels for android malware. In: 2017 IEEE\/ACM 14th International Conference on Mining Software Repositories (MSR), pp. 425\u2013435. IEEE (2017)","DOI":"10.1109\/MSR.2017.57"},{"key":"575_CR12","unstructured":"IDA. (2023). https:\/\/hex-rays.com\/ida-free\/"},{"key":"575_CR13","unstructured":"inmobi. (2024). https:\/\/www.inmobi.com\/"},{"key":"575_CR14","unstructured":"jadx. (2023). https:\/\/github.com\/skylot\/jadx"},{"key":"575_CR15","unstructured":"JavascriptInterface. (2024). https:\/\/developer.android.com\/reference\/android\/webkit\/JavascriptInterface"},{"key":"575_CR16","unstructured":"javascript-interfaces. (2022). https:\/\/securityqueens.co.uk\/android-attack-javascript-interfaces-and-webviews\/"},{"key":"575_CR17","unstructured":"Koodous. (2023). https:\/\/koodous.com\/"},{"key":"575_CR18","doi-asserted-by":"crossref","unstructured":"Li, L., Bissyand\u00e9, T.F., Klein, J., Le\u00a0Traon, Y.: An investigation into the use of common libraries in android apps. In: 2016 IEEE 23Rd International Conference on Software Analysis, Evolution, and Reengineering (SANER), vol. 1, pp. 403\u2013414. IEEE (2016)","DOI":"10.1109\/SANER.2016.52"},{"issue":"6","key":"575_CR19","doi-asserted-by":"publisher","first-page":"1269","DOI":"10.1109\/TIFS.2017.2656460","volume":"12","author":"L Li","year":"2017","unstructured":"Li, L., Li, D., Bissyand\u00e9, T.F., Klein, J., Le Traon, Y., Lo, D., Cavallaro, L.: Understanding android app piggybacking: A systematic study of malicious code grafting. IEEE Trans. Inf. Forensics Secur. 12(6), 1269\u20131284 (2017)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"575_CR20","doi-asserted-by":"crossref","unstructured":"Liu, T., Wang, H., Li, L., Bai, G., Guo, Y., Xu, G.: Dapanda: Detecting aggressive push notifications in android apps. In: 2019 34th IEEE\/ACM International Conference on Automated Software Engineering (ASE), pp. 66\u201378. IEEE (2019)","DOI":"10.1109\/ASE.2019.00017"},{"key":"575_CR21","doi-asserted-by":"crossref","unstructured":"Ma, Z., Wang, H., Guo, Y., Chen, X.: Libradar: fast and accurate detection of third-party libraries in android apps. In: Proceedings of the 38th International Conference on Software Engineering Companion, pp. 653\u2013656. ACM (2016)","DOI":"10.1145\/2889160.2889178"},{"key":"575_CR22","doi-asserted-by":"crossref","unstructured":"Poeplau, S., Fratantonio, Y., Bianchi, A., Kruegel, C., Vigna, G.: Execute this! analyzing unsafe and malicious dynamic code loading in android applications. In: NDSS, vol. 14, pp. 23\u201326 (2014)","DOI":"10.14722\/ndss.2014.23328"},{"key":"575_CR23","doi-asserted-by":"crossref","unstructured":"Sebasti\u00e1n, S., Caballero, J.: Avclass2: Massive malware tag extraction from av labels. In: Annual Computer Security Applications Conference, pp. 42\u201353 (2020)","DOI":"10.1145\/3427228.3427261"},{"key":"575_CR24","unstructured":"secret-inside-of-so-file. (2024). https:\/\/medium.com\/@jinwei.han93\/secret-inside-of-so-file-c073c8375c63"},{"key":"575_CR25","doi-asserted-by":"publisher","first-page":"147","DOI":"10.1007\/s11416-018-0328-8","volume":"15","author":"S Suresh","year":"2019","unstructured":"Suresh, S., Di Troia, F., Potika, K., Stamp, M.: An analysis of android adware. J. Comput. Virol. Hacking Techn. 15, 147\u2013160 (2019)","journal-title":"J. Comput. Virol. Hacking Techn."},{"key":"575_CR26","unstructured":"The mobile malware threat landscape in 2023. (2024). https:\/\/securelist.com\/mobile-malware-report-2023\/111964\/"},{"key":"575_CR27","unstructured":"Virustotal. (2023). https:\/\/www.virustotal.com\/"},{"key":"575_CR28","doi-asserted-by":"crossref","unstructured":"Wang, C., Liu, T., Zhao, Y., Zhang, L., Du, X., Li, L., Wang, H.: Towards demystifying android adware: Dataset and payload location. In: Proceedings of the 39th IEEE\/ACM International Conference on Automated Software Engineering Workshops, pp. 167\u2013175 (2024)","DOI":"10.1145\/3691621.3694948"},{"key":"575_CR29","doi-asserted-by":"crossref","unstructured":"Wang, H., Si, J., Li, H., Guo, Y.: Rmvdroid: Towards a reliable android malware dataset with app metadata. In: 2019 IEEE\/ACM 16th International Conference on Mining Software Repositories (MSR), pp. 404\u2013408. IEEE (2019)","DOI":"10.1109\/MSR.2019.00067"},{"issue":"2","key":"575_CR30","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3530906","volume":"6","author":"L Wang","year":"2022","unstructured":"Wang, L., Wang, H., He, R., Tao, R., Meng, G., Luo, X., Liu, X.: Malradar: Demystifying android malware in the new era. Proc. ACM Meas. Anal. Comput. Syst. 6(2), 1\u201327 (2022)","journal-title":"Proc. ACM Meas. Anal. Comput. Syst."},{"key":"575_CR32","doi-asserted-by":"crossref","unstructured":"Wei, F., Li, Y., Roy, S., Ou, X., Zhou, W.: Deep ground truth analysis of current android malware. In: International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, pp. 252\u2013276. Springer (2017)","DOI":"10.1007\/978-3-319-60876-1_12"},{"key":"575_CR33","unstructured":"Well Known Ad-Networks. (2024). https:\/\/www.appbrain.com\/stats\/libraries\/ad-networks"},{"key":"575_CR34","unstructured":"What is a adware. (2024). https:\/\/www.techtarget.com\/searchsecurity\/definition\/adware"},{"key":"575_CR35","unstructured":"What is a greyware. (2024). https:\/\/www.malwarebytes.com\/glossary\/greyware?srsltid=AfmBOoqKBDEZ2hWoLZpLcj8j0FySWgliAuicMgFJ-cj49wkQJuuMwcLg"},{"key":"575_CR36","unstructured":"What is PUAs. (2024). https:\/\/en.wikipedia.org\/wiki\/Potentially_unwanted_program"},{"key":"575_CR37","unstructured":"Wu, L.: Fake Android Apps Communicate For Malware, Ad Fraud. (2020). https:\/\/www.trendmicro.com\/en_us\/research\/20\/b\/malicious-apps-on-google-play-communicate-with-trojans-install-malware-perform-mobile-ad-fraud.html"},{"key":"575_CR38","unstructured":"Xu, E.: Adware Posing as 85 Photography and Gaming Apps on Google Play Installed Over 8 Million Times. (2019). https:\/\/www.trendmicro.com\/en_us\/research\/19\/h\/adware-posing-as-85-photography-and-gaming-apps-on-google-play-installed-over-8-million-times.html"},{"issue":"7","key":"575_CR39","doi-asserted-by":"publisher","first-page":"1529","DOI":"10.1109\/TIFS.2017.2661723","volume":"12","author":"Y Xue","year":"2017","unstructured":"Xue, Y., Meng, G., Liu, Y., Tan, T.H., Chen, H., Sun, J., Zhang, J.: Auditing anti-malware tools by evolving android malware and dynamic loading technique. IEEE Trans. Inf. Forensics Secur. 12(7), 1529\u20131544 (2017)","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"575_CR40","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Diao, W., Hu, C., Guo, S., Zuo, C., Li, L.: An empirical study of potentially malicious third-party libraries in android apps. In: Proceedings of the 13th ACM Conference on Security and Privacy in Wireless and Mobile Networks, pp. 144\u2013154 (2020)","DOI":"10.1145\/3395351.3399346"},{"issue":"3","key":"575_CR41","first-page":"1","volume":"30","author":"Y Zhao","year":"2021","unstructured":"Zhao, Y., Li, L., Wang, H., Cai, H., Bissyand\u00e9, T.F., Klein, J., Grundy, J.: On the impact of sample duplication in machine-learning-based android malware detection. ACM Trans. Softw. Eng. Methodology (TOSEM) 30(3), 1\u201338 (2021)","journal-title":"ACM Trans. Softw. Eng. Methodology (TOSEM)"},{"key":"575_CR42","unstructured":"Zheng, C., Xu, Z.: New Android Malware Family Evades Antivirus Detection By Using Popular Ad Libraries. (2015). https:\/\/unit42.paloaltonetworks.com\/new-android-malware-family-evades-antivirus-detection-by-using-popular-ad-libraries\/"},{"key":"575_CR43","doi-asserted-by":"crossref","unstructured":"Zhou, Y., Jiang, X.: Dissecting android malware: Characterization and evolution. In: 2012 IEEE Symposium on Security and Privacy, pp. 95\u2013109. IEEE (2012)","DOI":"10.1109\/SP.2012.16"},{"key":"575_CR44","unstructured":"Zhu, S., Shi, J., Yang, L., Qin, B., Zhang, Z., Song, L., Wang, G.: Measuring and modeling the label dynamics of online $$\\{$$Anti-Malware$$\\}$$ engines. In: 29th USENIX Security Symposium (USENIX Security 20), pp. 2361\u20132378 (2020)"}],"container-title":["Automated Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-025-00575-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10515-025-00575-9","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10515-025-00575-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T11:15:12Z","timestamp":1768821312000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10515-025-00575-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,11,11]]},"references-count":43,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2026,5]]}},"alternative-id":["575"],"URL":"https:\/\/doi.org\/10.1007\/s10515-025-00575-9","relation":{},"ISSN":["0928-8910","1573-7535"],"issn-type":[{"value":"0928-8910","type":"print"},{"value":"1573-7535","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,11,11]]},"assertion":[{"value":"31 March 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 October 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 November 2025","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable since there are no human and\/or animal studies included in this paper.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical Approval"}},{"value":"Non-financial interests: Author Li Li is an Editor for the Special Issue on Advances in Mobile App Analysis and Systems in the ASE Journal.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"30"}}