{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T05:06:22Z","timestamp":1780635982653,"version":"3.54.1"},"reference-count":62,"publisher":"Oxford University Press (OUP)","issue":"11","license":[{"start":{"date-parts":[[2022,8,20]],"date-time":"2022-08-20T00:00:00Z","timestamp":1660953600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"funder":[{"name":"Science and Technology Development Fund of Macau","award":["0047\/2020\/A1"],"award-info":[{"award-number":["0047\/2020\/A1"]}]},{"DOI":"10.13039\/501100002858","name":"China Postdoctoral Science Foundation","doi-asserted-by":"publisher","award":["2017M621247"],"award-info":[{"award-number":["2017M621247"]}],"id":[{"id":"10.13039\/501100002858","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100005046","name":"Natural Science Foundation of Heilongjiang Province","doi-asserted-by":"publisher","award":["LH2019F008"],"award-info":[{"award-number":["LH2019F008"]}],"id":[{"id":"10.13039\/501100005046","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Key Laboratory of Dependable Service Computing in Cyber-Physical-Society"},{"DOI":"10.13039\/501100002369","name":"Chongqing University","doi-asserted-by":"publisher","award":["CPSDSC202004"],"award-info":[{"award-number":["CPSDSC202004"]}],"id":[{"id":"10.13039\/501100002369","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61902306"],"award-info":[{"award-number":["61902306"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,11,14]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Each malware application belongs to a specific malware family, and each family has unique characteristics. However, existing Android malware detection schemes do not pay attention to the use of malware family information. If the family information is exploited well, it could improve the accuracy of malware detection. In this paper, we propose a general Ensemble framework combining Family Information for Android Malware Detector, called EFIMDetector. First, eight categories of features are extracted from Android application packages. Then, we define the malware family with a large sample size as a prosperous family and construct a classifier for each prosperous family as a conspicuousness evaluator for the family characteristics. These conspicuousness evaluators are combined with a general classifier (which can be a base or ensemble classifier in itself), called the final classifier, to form a two-layer ensemble framework. For the samples of prosperous families with conspicuous family characteristics, the conspicuousness evaluators directly provide detection results. For other samples (including the samples of prosperous families with nonconspicuous family characteristics and the samples of nonprosperous families), the final classifier is responsible for detection. Seven common base classifiers and three common ensemble classifiers are used to detect malware in the experiment. The results show that the proposed ensemble framework can effectively improve the detection accuracy of these classifiers.<\/jats:p>","DOI":"10.1093\/comjnl\/bxac114","type":"journal-article","created":{"date-parts":[[2022,8,22]],"date-time":"2022-08-22T11:37:36Z","timestamp":1661168256000},"page":"2721-2740","source":"Crossref","is-referenced-by-count":5,"title":["Ensemble Framework Combining Family Information for Android Malware Detection"],"prefix":"10.1093","volume":"66","author":[{"given":"Yao","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, Macau University of Science and Technology, Avenida Wai Long , Taipa, Macau, Macao SAR, 999078 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhi","family":"Xiong","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Shantou University, Shantou, University Road , Shantou, Guangdong Province, 515063 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, Macau University of Science and Technology, Avenida Wai Long , Taipa, Macau, Macao SAR, 999078 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qinkun","family":"Zhang","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Technology, Shantou University, Shantou, University Road , Shantou, Guangdong Province, 515063 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ming","family":"Fan","sequence":"additional","affiliation":[{"name":"Key Laboratory of Dependable Service Computing in Cyber Physical Society, Ministry of Education of China, Chongqing University , Chongqing, 400044 , China"},{"name":"Xi\u2019an Jiaotong University, Xianning West Road , Xi\u2019an, Shaanxi, 710049 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lei","family":"Xue","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University , Hung Hom, Kowloon, Hong Kong SAR, 999077 , China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2022,8,20]]},"reference":[{"key":"2023111618464738100_ref1","article-title":"Android\u2014Statistics & Facts","author":"O\u2019Dea","year":"2020","journal-title":"Stat"},{"key":"2023111618464738100_ref2","volume-title":"G DATA Mobile Malware Report: Harmful Android Apps Every Eight Seconds","author":"Beckert-Plewka","year":"2020"},{"key":"2023111618464738100_ref3","article-title":"Mobile malware evolution 2020","author":"Chebyshev","year":"2021","journal-title":"Kaspersky"},{"key":"2023111618464738100_ref4","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1109\/TSE.2018.2886875","article-title":"Ppchecker: towards accessing the trustworthiness of android apps\u2019 privacy policies","volume":"47","author":"Yu","year":"2021","journal-title":"IEEE Trans. Softw. Eng."},{"key":"2023111618464738100_ref5","doi-asserted-by":"crossref","first-page":"1890","DOI":"10.1109\/TIFS.2018.2806891","article-title":"Android malware familial classification and representative sample selection via frequent subgraph analysis","volume":"13","author":"Fan","year":"2018","journal-title":"IEEE Trans. Inform. Forensics Secur."},{"key":"2023111618464738100_ref6","doi-asserted-by":"crossref","first-page":"10614","DOI":"10.1109\/ACCESS.2020.2965646","article-title":"Android malware familial classification based on dex file section features","volume":"8","author":"Fang","year":"2020","journal-title":"IEEE Access"},{"key":"2023111618464738100_ref7","doi-asserted-by":"crossref","first-page":"57205","DOI":"10.1109\/ACCESS.2018.2873583","article-title":"An in-depth study of the jisut family of android ransomware","volume":"6","author":"Martin","year":"2020","journal-title":"IEEE Access"},{"key":"2023111618464738100_ref8","doi-asserted-by":"crossref","first-page":"785","DOI":"10.1145\/2939672.2939785","volume-title":"22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","author":"Chen","year":"2016"},{"key":"2023111618464738100_ref9","doi-asserted-by":"crossref","first-page":"1189","DOI":"10.1214\/aos\/1013203451","article-title":"Greedy function approximation: a gradient boosting machine","volume":"29","author":"Friedman","year":"2001","journal-title":"Ann. Stat."},{"key":"2023111618464738100_ref10","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1007\/BF00058655","article-title":"Bagging predictors","volume":"24","author":"Breiman","year":"1996","journal-title":"Mach. Learn."},{"key":"2023111618464738100_ref11","doi-asserted-by":"crossref","first-page":"102086","DOI":"10.1016\/j.cose.2020.102086","article-title":"Jowmdroid: android malware detection based on feature weighting with joint optimization of weight-mapping and classifier parameters - sciencedirect","volume":"100","author":"Lca","year":"2021","journal-title":"Comput. Secur."},{"key":"2023111618464738100_ref12","doi-asserted-by":"crossref","first-page":"3353","DOI":"10.1007\/s00521-017-2914-y","article-title":"Hemd: a highly efficient random forest-based malware detection framework for android","volume":"30","author":"Zhu","year":"2017","journal-title":"Neural Comput. Applic."},{"key":"2023111618464738100_ref13","first-page":"95","article-title":"Dissecting android malware: characterization and evolution","author":"Zhou","year":"2012","journal-title":"IEEE Symp. Secur. Privacy"},{"key":"2023111618464738100_ref14","first-page":"333","volume-title":"10th International Conference on Availability, Reliability and Security","author":"Canfora","year":"2015"},{"key":"2023111618464738100_ref15","volume-title":"APKtool","author":"Tumbleson"},{"key":"2023111618464738100_ref16","volume-title":"Androguard, a full python tool to play with Android files","author":"Desnos"},{"key":"2023111618464738100_ref17","first-page":"1","article-title":"Drebin: effective and explainable detection of android malware in your pocket","author":"Arp","year":"2014","journal-title":"the Network and Distributed System Security Symposium"},{"key":"2023111618464738100_ref18","doi-asserted-by":"crossref","first-page":"773","DOI":"10.1109\/TIFS.2018.2866319","article-title":"A multimodal deep learning method for android malware detection using various features","volume":"14","author":"Kim","year":"2019","journal-title":"IEEE Trans. Inform. Forensics Secur."},{"key":"2023111618464738100_ref19","doi-asserted-by":"crossref","first-page":"453","DOI":"10.1109\/TCYB.2017.2777960","article-title":"Droidfusion: a novel multilevel classifier fusion approach for android malware detection","volume":"49","author":"Yerima","year":"2019","journal-title":"IEEE Trans. Cybernet."},{"key":"2023111618464738100_ref20","doi-asserted-by":"crossref","first-page":"83","DOI":"10.1109\/TDSC.2016.2536605","article-title":"Madam: effective and efficient behavior-based android malware detection and prevention","volume":"15","author":"Saracino","year":"2018","journal-title":"IEEE Trans. Dependable Secure Comput."},{"key":"2023111618464738100_ref21","doi-asserted-by":"crossref","first-page":"30996","DOI":"10.1109\/ACCESS.2018.2844349","article-title":"A novel dynamic android malware detection system with ensemble learning","volume":"6","author":"Feng","year":"2018","journal-title":"IEEE Access"},{"key":"2023111618464738100_ref22","first-page":"320","volume-title":"5th International Conference on Computer Science and Network Technology","author":"Fei","year":"2016"},{"key":"2023111618464738100_ref23","doi-asserted-by":"crossref","first-page":"117","DOI":"10.1016\/j.asoc.2016.01.044","article-title":"A hybrid particle swarm optimization for feature subset selection by integrating a novel local search strategy","volume":"43","author":"Moradi","year":"2016","journal-title":"Appl. Soft Comput."},{"key":"2023111618464738100_ref24","doi-asserted-by":"crossref","first-page":"252","DOI":"10.1007\/978-3-319-60876-1_12","article-title":"Deep ground truth analysis of current android malware","author":"Wei","year":"2017","journal-title":"Int. Conf. Detect. Intrusions Malware Vulnerability Assess."},{"key":"2023111618464738100_ref25","doi-asserted-by":"crossref","first-page":"736","DOI":"10.1109\/TNSE.2021.3051354","article-title":"A framework for enhancing deep neural networks against adversarial malware","volume":"8","author":"Li","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"2023111618464738100_ref26","first-page":"188","volume-title":"27th Asia-Pacific Software Engineering Conference","author":"Ma","year":"2020"},{"key":"2023111618464738100_ref27","doi-asserted-by":"crossref","first-page":"5093","DOI":"10.1109\/TIFS.2021.3124725","article-title":"Specview: malware spectrum visualization framework with singular spectrum transformation","volume":"16","author":"Yu","year":"2021","journal-title":"IEEE Trans. Inform. Forensics Secur."},{"key":"2023111618464738100_ref28","doi-asserted-by":"crossref","first-page":"221","DOI":"10.1145\/2591971.2592003","volume-title":"The 2014 ACM International Conference on Measurement and Modeling of Computer Systems","author":"Viennot","year":"2014"},{"key":"2023111618464738100_ref29","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3313391","article-title":"Mamadroid: detecting android malware by building Markov chains of behavioral models","volume":"22","author":"Mariconti","year":"2019","journal-title":"ACM Trans. Privacy Secur."},{"key":"2023111618464738100_ref30","doi-asserted-by":"crossref","first-page":"984","DOI":"10.1109\/TNSE.2020.2996379","article-title":"Sedmdroid: an enhanced stacking ensemble framework for android malware detection","volume":"8","author":"Zhu","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"2023111618464738100_ref31","volume-title":"Android Malware","author":"Sk3ptre"},{"key":"2023111618464738100_ref32","author":"VirusShare"},{"key":"2023111618464738100_ref33","doi-asserted-by":"crossref","first-page":"468","DOI":"10.1145\/2901739.2903508","volume-title":"13th International Conference on Mining Software Repositories","author":"Allix","year":"2016"},{"key":"2023111618464738100_ref34","doi-asserted-by":"crossref","first-page":"91","DOI":"10.1016\/j.future.2021.02.015","article-title":"Research on unsupervised feature learning for android malware detection based on restricted Boltzmann machines","volume":"120","author":"Liu","year":"2021","journal-title":"Fut. Gener. Comput. Syst."},{"key":"2023111618464738100_ref35","doi-asserted-by":"crossref","first-page":"355","DOI":"10.1109\/TR.2017.2778147","article-title":"Malpat: mining patterns of malicious and benign android apps via permission-related APIS","volume":"67","author":"Tao","year":"2018","journal-title":"IEEE Trans. Reliab."},{"key":"2023111618464738100_ref36","doi-asserted-by":"crossref","first-page":"5071","DOI":"10.1007\/s12652-020-01957-5","article-title":"A novel permission ranking system for android malware detection-the permission grader","volume":"12","author":"Dharmalingam","year":"2020","journal-title":"J. Ambient Intell. Humanized Comput."},{"key":"2023111618464738100_ref37","first-page":"411","volume-title":"12th International Conference on Network and System Security","author":"Zhi","year":"2018"},{"key":"2023111618464738100_ref38","doi-asserted-by":"crossref","first-page":"509","DOI":"10.1016\/j.future.2020.02.002","article-title":"Intelligent mobile malware detection using permission requests and API calls","volume":"107","author":"Alazab","year":"2020","journal-title":"Fut. Gener. Comput. Syst."},{"key":"2023111618464738100_ref39","doi-asserted-by":"crossref","first-page":"14781","DOI":"10.1007\/s00521-020-04831-9","article-title":"On defending against label flipping attacks on malware detection systems","volume":"32","author":"Taheri","year":"2020","journal-title":"Neural Comput. Appl."},{"key":"2023111618464738100_ref40","doi-asserted-by":"crossref","first-page":"59","DOI":"10.1007\/s10207-020-00489-5","article-title":"Nsdroid: efficient multi-classification of android malware using neighborhood signature in local function call graphs","volume":"20","author":"Liu","year":"2021","journal-title":"Int. J. Inform. Secur."},{"key":"2023111618464738100_ref41","doi-asserted-by":"crossref","first-page":"102264","DOI":"10.1016\/j.cose.2021.102264","article-title":"Gdroid: android malware detection and classification with graph convolutional network","volume":"20","author":"Gao","year":"2021","journal-title":"Comput. Secur."},{"key":"2023111618464738100_ref42","doi-asserted-by":"crossref","first-page":"21235","DOI":"10.1109\/ACCESS.2019.2896003","article-title":"A combination method for android malware detection based on control flow graphs and machine learning algorithms","volume":"7","author":"Ma","year":"2019","journal-title":"IEEE Access"},{"key":"2023111618464738100_ref43","doi-asserted-by":"crossref","first-page":"3133","DOI":"10.1007\/s00521-020-05195-w","article-title":"Visdroid: android malware classification based on local and global image features, bag of visual words and machine learning techniques","volume":"33","author":"Bakour","year":"2021","journal-title":"Neural Comput. Appl."},{"key":"2023111618464738100_ref44","doi-asserted-by":"crossref","first-page":"5639","DOI":"10.1002\/sec.1723","article-title":"A collaborative approach on host and network level android malware detection","volume":"9","author":"Bae","year":"2016","journal-title":"Secur. Commun. Netw."},{"key":"2023111618464738100_ref45","doi-asserted-by":"crossref","first-page":"333","DOI":"10.1016\/j.future.2018.11.021","article-title":"A machine learning based approach to detect malicious android apps using discriminant system calls","volume":"94","author":"Vp","year":"2019","journal-title":"Fut. Gener. Comput. Syst."},{"key":"2023111618464738100_ref46","doi-asserted-by":"crossref","first-page":"3529","DOI":"10.1007\/s11042-018-6498-z","article-title":"A novel approach for mobile malware classification and detection in android systems","volume":"78","author":"Zhou","year":"2019","journal-title":"Multimed. Tools Appl."},{"key":"2023111618464738100_ref47","doi-asserted-by":"crossref","first-page":"248","DOI":"10.1109\/TR.2020.2982537","article-title":"On existence of common malicious system call codes in android malware families","volume":"70","author":"Surendran","year":"2020","journal-title":"IEEE Trans. Reliab."},{"key":"2023111618464738100_ref48","first-page":"326","article-title":"Androdfa: android malware classification based on resource consumption","volume":"11","author":"Massarelli","year":"2020","journal-title":"Information (Switzerland)"},{"key":"2023111618464738100_ref49","first-page":"468","volume-title":"International Conference on Computing, Networking and Communications","author":"Hansen","year":"2016"},{"key":"2023111618464738100_ref50","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3464323","article-title":"Detection android malware and classifying its families in large-scale datasets","volume":"13","author":"Sun","year":"2021","journal-title":"ACM Trans. Manag. Inf. Syst."},{"key":"2023111618464738100_ref51","doi-asserted-by":"crossref","first-page":"103115","DOI":"10.1016\/j.micpro.2020.103115","article-title":"Detecting android malware using an improved filter based technique in embedded software","volume":"76","author":"Varna","year":"2020","journal-title":"Microprocess. Microsyst."},{"key":"2023111618464738100_ref52","doi-asserted-by":"crossref","first-page":"858","DOI":"10.3390\/sym12050858","article-title":"A lightweight android malware classifier using novel feature selection methods","volume":"12","author":"Salah","year":"2020","journal-title":"Symmetry"},{"key":"2023111618464738100_ref53","doi-asserted-by":"crossref","first-page":"230","DOI":"10.1016\/j.future.2019.11.034","article-title":"Similarity-based android malware detection using hamming distance of static binary features","volume":"105","author":"Rt","year":"2020","journal-title":"Fut. Gener. Comput. Syst."},{"key":"2023111618464738100_ref54","doi-asserted-by":"crossref","first-page":"4966","DOI":"10.3390\/app10144966","article-title":"Hybrid malware classification method using segmentation-based fractal texture analysis and deep convolution neural network features","volume":"10","author":"Nisa","year":"2020","journal-title":"Appl. Sci."},{"key":"2023111618464738100_ref55","first-page":"1572","article-title":"A comparison of machine learning techniques for android malware detection using apache spark","volume":"14","author":"Memon","year":"2019","journal-title":"J. Eng. Sci. Technol."},{"key":"2023111618464738100_ref56","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1145\/2382196.2382222","article-title":"Pscout: analyzing the android permission specification","author":"Au","year":"2012","journal-title":"ACM Conf. Comput. Commun. Secur."},{"key":"2023111618464738100_ref57","first-page":"358","volume-title":"IEEE\/ACM 39th International Conference on Software Engineering","author":"Xue","year":"2017"},{"key":"2023111618464738100_ref58","first-page":"293","volume-title":"20th European Symposium on Research in Computer Security","author":"Zhang","year":"2015"},{"key":"2023111618464738100_ref59","author":"VIRUSTOTAL"},{"key":"2023111618464738100_ref60","author":"Avira AntiVirus"},{"key":"2023111618464738100_ref61","author":"Kaspersky"},{"key":"2023111618464738100_ref62","first-page":"139","volume-title":"34th IEEE\/ACM International Conference on Automated Software Engineering","author":"Wu","year":"2019"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/11\/2721\/53401132\/bxac114.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/66\/11\/2721\/53401132\/bxac114.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,16]],"date-time":"2023-11-16T18:48:04Z","timestamp":1700160484000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/66\/11\/2721\/6672798"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,8,20]]},"references-count":62,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2022,8,20]]},"published-print":{"date-parts":[[2023,11,14]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxac114","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"value":"0010-4620","type":"print"},{"value":"1460-2067","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2023,11]]},"published":{"date-parts":[[2022,8,20]]}}}