{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,24]],"date-time":"2026-06-24T16:06:28Z","timestamp":1782317188652,"version":"3.54.5"},"reference-count":35,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2017,9,2]],"date-time":"2017-09-02T00:00:00Z","timestamp":1504310400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"name":"NSFC projects","award":["61202358, 61379041, 61402255, 61371078"],"award-info":[{"award-number":["61202358, 61379041, 61402255, 61371078"]}]},{"name":"the National High-tech R&D Program of China","award":["2015AA016102"],"award-info":[{"award-number":["2015AA016102"]}]},{"DOI":"10.13039\/501100003453","name":"Natural Science Foundation of Guangdong Province","doi-asserted-by":"crossref","award":["2015A030310492"],"award-info":[{"award-number":["2015A030310492"]}],"id":[{"id":"10.13039\/501100003453","id-type":"DOI","asserted-by":"crossref"}]},{"name":"R&D Program of Shenzhen","award":["JCYJ20160301152145171, JCYJ20150630170146831, ZDSYS20140509172959989, JSGG20150512162853495, Shenfagai [2015] 986"],"award-info":[{"award-number":["JCYJ20160301152145171, JCYJ20150630170146831, ZDSYS20140509172959989, JSGG20150512162853495, Shenfagai [2015] 986"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Multimed Tools Appl"],"published-print":{"date-parts":[[2019,2]]},"DOI":"10.1007\/s11042-017-5104-0","type":"journal-article","created":{"date-parts":[[2017,9,2]],"date-time":"2017-09-02T03:46:44Z","timestamp":1504324004000},"page":"3979-3999","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":208,"title":["Android malware detection based on system call sequences and LSTM"],"prefix":"10.1007","volume":"78","author":[{"given":"Xi","family":"Xiao","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shaofeng","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Francesco","family":"Mercaldo","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3947-9998","authenticated-orcid":false,"given":"Guangwu","family":"Hu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Arun Kumar","family":"Sangaiah","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2017,9,2]]},"reference":[{"key":"5104_CR1","doi-asserted-by":"crossref","unstructured":"Arp D, Spreitzenbarth M, Hubner M, et al (2014) DREBIN: Effective and Explainable Detection of Android Malware in Your Pocket, in: Proceeding of 21th Annual Network and Distributed System Security Symposium (NDSS), San Diego, 2014","DOI":"10.14722\/ndss.2014.23247"},{"key":"5104_CR2","first-page":"228","volume":"2","author":"Z Aung","year":"2013","unstructured":"Aung Z, Zaw W (2013) Permission-based android malware detection. Int J Sci Technol Res 2:228\u2013234","journal-title":"Int J Sci Technol Res"},{"key":"5104_CR3","doi-asserted-by":"crossref","unstructured":"Battista P, Mercaldo F, Nardone V, et al (2016) Identification of Android Malware Families with Model Checking, in: Proceeding of International Conference on Information Systems Security and Privacy, Rome, 2016","DOI":"10.5220\/0005809205420547"},{"key":"5104_CR4","unstructured":"Bengio Y, Simard P, Frasconi P (1994) Learning long-term dependencies with gradient descent is difficult, IEEE Press, Neural Networks, 5(2) (1994), pp. 157\u2013166"},{"key":"5104_CR5","first-page":"1137","volume":"3","author":"Y Bengio","year":"2003","unstructured":"Bengio Y, Schwenk H, Sen\u00e9cal J et al (2003) Probabilistic language models. J Mach Learn Res 3:1137\u20131155","journal-title":"J Mach Learn Res"},{"key":"5104_CR6","doi-asserted-by":"crossref","unstructured":"Canfora G, Medvet E, Mercaldo F, et al (2015) Detecting Android malware using sequences of system calls, in: Proceeding of International Workshop on Software Development Lifecycle for Mobile (DeMobile), 2015, pp 13\u201320","DOI":"10.1145\/2804345.2804349"},{"key":"5104_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.cose.2016.04.009","volume":"61","author":"G Canfora","year":"2016","unstructured":"Canfora G, Mercaldo F, Visaggio CA (2016) An HMM and structural entropy based detector for android malware: an empirical study. Comput Secur 61:1\u201318","journal-title":"Comput Secur"},{"key":"5104_CR8","doi-asserted-by":"publisher","first-page":"193","DOI":"10.1016\/j.ins.2015.04.035","volume":"321","author":"PS Chen","year":"2015","unstructured":"Chen PS, Lin SC, Sun CH (2015) Simple and effective method for detecting abnormal internet behaviors of mobile devices. Inf Sci 321:193\u2013204","journal-title":"Inf Sci"},{"key":"5104_CR9","doi-asserted-by":"crossref","unstructured":"Chen S, Xue M, Tang Z, et al (2016) StormDroid: A Streaminglized Machine Learning-Based System for Detecting Android Malware, in: Proceeding of ACM on Asia Conference on Computer and Communications Security(ASIACCS), Xian, 2016, pp 377\u2013388","DOI":"10.1145\/2897845.2897860"},{"key":"5104_CR10","unstructured":"Dimja, Marko, Atzeni S, et al (2016) Evaluation of Android Malware Detection Based on System Calls. In: Proceedings of ACM on International Workshop on Security and Privacy Analytics (IWSPA), New Orlean, pp 1\u20138"},{"key":"5104_CR11","doi-asserted-by":"crossref","unstructured":"Elman JL (1990) Finding structure in time 1990. Cogn Sci 14:179\u2013211","DOI":"10.1207\/s15516709cog1402_1"},{"key":"5104_CR12","doi-asserted-by":"crossref","unstructured":"Feng Y, Anand S, Dillig I, et al (2014) Apposcopy: semantics-based detection of Android malware through static analysis, in: Proceeding of 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE14), Hong Kong, 2014, pp 576\u2013587","DOI":"10.1145\/2635868.2635869"},{"key":"5104_CR13","unstructured":"FireEye, Out of Pocket (2015): A Comprehensive Mobile Threat Assessment of 7 Million iOS and Android Apps, < https:\/\/www.fireeye.com\/rs\/fireeye\/images\/rpt-mobilethreat assessment.pdf>, (accessed 17.08.27)"},{"key":"5104_CR14","doi-asserted-by":"crossref","unstructured":"Graves A (2012), Supervised Sequence Labelling with Recurrent Neural Networks. Studies in Computational Intelligence","DOI":"10.1007\/978-3-642-24797-2"},{"key":"5104_CR15","doi-asserted-by":"publisher","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","volume":"9","author":"S Hochreiter","year":"1997","unstructured":"Hochreiter S, Schmidhuber J (1997) Long short-term memory. Neural Comput 9:1735\u20131780","journal-title":"Neural Comput"},{"key":"5104_CR16","doi-asserted-by":"crossref","unstructured":"Li Q, Li X (2015) Android Malware Detection Based on Static Analysis of Characteristic Tree, in: Proceeding of International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, Xian, 2015, pp 84\u201391","DOI":"10.1109\/CyberC.2015.88"},{"key":"5104_CR17","doi-asserted-by":"crossref","unstructured":"Li Y, Shen T, Sun X, et al (2015) Detection, Classification and Characterization of Android Malware Using API Data Dependency, in: Proceeding of International Conference on Security and Privacy in Communication Systems(SecureComm2015), Dallas, 2015, pp 23\u201340","DOI":"10.1007\/978-3-319-28865-9_2"},{"key":"5104_CR18","unstructured":"Lunden I. (2015) 6.1b smartphone users globally by 2020, overtaking basic fixed phone subscriptions.< http:\/\/techcrunch.com\/2015\/06\/02\/6-1b-smartphone-users-globally-by-2020-overtaking-basic-fixed-phone-subscriptions >, (accessed 17.08.27)"},{"key":"5104_CR19","unstructured":"android-market-api-py. < https:\/\/github.com\/liato\/android-market-api-py> (accessed 17.08.27)"},{"key":"5104_CR20","doi-asserted-by":"crossref","unstructured":"Mercaldo F, Nardone V, Santone A, et al (2016) Download Malware? No, Thanks. How Formal Methods Can Block Update Attacks, in: Proceeding of Fme Workshop on Formal Methods in Software Engineering, Austin, 2016, pp 22\u201328","DOI":"10.1145\/2897667.2897673"},{"key":"5104_CR21","doi-asserted-by":"crossref","unstructured":"Mercaldo F, Nardone V, Santone A, et al (2016) Ransomware Steals Your Phone. Formal Methods Rescue It, in: Proceeding of International Conference on Formal Techniques for Distributed Objects, Components, and Systems, Heraklion, Crete, Greece, 2016, pp 212\u2013221","DOI":"10.1007\/978-3-319-39570-8_14"},{"key":"5104_CR22","doi-asserted-by":"crossref","unstructured":"Mikolov T, Karafiat M, Burget L, et al (2010) Recurrent neural network based language model, in: Proceeding of the Annual Conference of the International Speech Communication Association (Interspeech 2010), Makuhari, 2010, pp 1045\u20131048","DOI":"10.21437\/Interspeech.2010-343"},{"key":"5104_CR23","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1016\/j.cose.2016.11.006","volume":"65","author":"B Rashidi","year":"2016","unstructured":"Rashidi B, Fung C, Bertino E (2016) Android resource usage risk assessment using hidden Markov model and online learning. Comput Secur 65:90\u2013107","journal-title":"Comput Secur"},{"key":"5104_CR24","unstructured":"Saracino A, Sgandurra D, Dini G, et al (2016) MADAM: Effective and Efficient Behavior-based Android Malware Detection and Prevention. IEEE Transactions on Dependable & Secure Computing, 2016, pp 1\u20131"},{"key":"5104_CR25","doi-asserted-by":"crossref","unstructured":"Sundermeyer M, Schluter R, Ney H (2012) LSTM Neural Networks for Language Modeling, in: Proceeding of the Annual Conference of the International Speech Communication Association (Interspeech2012), Portland, 2012, pp 601\u2013608","DOI":"10.21437\/Interspeech.2012-65"},{"key":"5104_CR26","unstructured":"System call https:\/\/en.wikipedia.org\/wiki\/System_call > (accessed 17.08.27)"},{"key":"5104_CR27","unstructured":"Tensorflow http:\/\/www.tensorflow.org > (accessed 17.08.27)"},{"key":"5104_CR28","doi-asserted-by":"crossref","unstructured":"Wang Z, Li C, Guan Y, et al (2015) DroidChain: A novel malware detection method for Android based on behavior chain, in: Proceeding of Communications and Network Security (CNS), FLORENCE, 2015, pp 727\u2013728","DOI":"10.1109\/CNS.2015.7346906"},{"key":"5104_CR29","doi-asserted-by":"crossref","unstructured":"Wu W C, Hung S H (2014) DroidDolphin: a dynamic Android malware detection framework using big data and machine learning, in: Proceeding of 2014 Conference on Research in Adaptive and Convergent Systems, Towson, 2014, pp 247\u2013252","DOI":"10.1145\/2663761.2664223"},{"key":"5104_CR30","doi-asserted-by":"publisher","first-page":"8","DOI":"10.1049\/iet-ifs.2015.0211","volume":"11","author":"X Xiao","year":"2017","unstructured":"Xiao X, Wang Z, Li Q et al (2017) Back-propagation neural network on Markov chains from system call sequences: a new approach for detecting android malware with system call sequences. IET Inf Secur 11:8\u201315","journal-title":"IET Inf Secur"},{"key":"5104_CR31","doi-asserted-by":"publisher","first-page":"1252","DOI":"10.1109\/TIFS.2016.2523912","volume":"11","author":"K Xu","year":"2016","unstructured":"Xu K, Li Y, Deng RH (2016) ICCDetector: ICC-based malware detection on android. IEEE Trans Inf Forensics Secur 11:1252\u20131264","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"5104_CR32","doi-asserted-by":"crossref","unstructured":"Yeh C W, Yeh W T, Hung S H, et al (2016) Flattened Data in Convolutional Neural Networks: Using Malware Detection as Case Study, in: Proceeding of International Conference on Research in Adaptive and Convergent Systems, Odense, 2016, pp 130\u2013135","DOI":"10.1145\/2987386.2987406"},{"key":"5104_CR33","doi-asserted-by":"crossref","unstructured":"Yu W, Ge L, Xu G, et al (2014) Towards Neural Network Based Malware Detection on Android Mobile Devices, Cybersecurity Systems for Human Cognition Augmentation, 2014, pp 99\u2013117","DOI":"10.1007\/978-3-319-10374-7_7"},{"key":"5104_CR34","unstructured":"Zhou Y, Jiang X (2012) Dissecting Android Malware: Characterization and Evolution, in: Proceedings of 33rd IEEE Symposium on Security and Privacy, SAN FRANCISCO, 2012, pp. 95\u2013109"},{"key":"5104_CR35","doi-asserted-by":"crossref","unstructured":"Zhou Y, Jiang X (2013) Android malware, Springer, New York, USA, 2013","DOI":"10.1007\/978-1-4614-7394-7"}],"container-title":["Multimedia Tools and Applications"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s11042-017-5104-0\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11042-017-5104-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s11042-017-5104-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,25]],"date-time":"2025-06-25T13:44:54Z","timestamp":1750859094000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s11042-017-5104-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,9,2]]},"references-count":35,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2019,2]]}},"alternative-id":["5104"],"URL":"https:\/\/doi.org\/10.1007\/s11042-017-5104-0","relation":{},"ISSN":["1380-7501","1573-7721"],"issn-type":[{"value":"1380-7501","type":"print"},{"value":"1573-7721","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,9,2]]},"assertion":[{"value":"22 March 2017","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 June 2017","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 August 2017","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 September 2017","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}