{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T02:13:05Z","timestamp":1773713585833,"version":"3.50.1"},"reference-count":75,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372086"],"award-info":[{"award-number":["62372086"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100018542","name":"Natural Science Foundation of Sichuan","doi-asserted-by":"crossref","award":["2025ZNSFSC0500"],"award-info":[{"award-number":["2025ZNSFSC0500"]}],"id":[{"id":"10.13039\/501100018542","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Chongqing Natural Science Foundation Innovation and Development Joint Fund","award":["CSTB2023NSCQLZX0003"],"award-info":[{"award-number":["CSTB2023NSCQLZX0003"]}]},{"name":"Sichuan Science and Technology Program","award":["2024NSFTD0031"],"award-info":[{"award-number":["2024NSFTD0031"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tdsc.2025.3629678","type":"journal-article","created":{"date-parts":[[2025,11,6]],"date-time":"2025-11-06T18:55:47Z","timestamp":1762455347000},"page":"2727-2744","source":"Crossref","is-referenced-by-count":0,"title":["PIEDChecker: Uncover Permissions-Independent Emulation-Detection Methods in Android System"],"prefix":"10.1109","volume":"23","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-0728-3741","authenticated-orcid":false,"given":"Ran","family":"Yan","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3235-3463","authenticated-orcid":false,"given":"Weina","family":"Niu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1119-4766","authenticated-orcid":false,"given":"Qinsheng","family":"Hou","sequence":"additional","affiliation":[{"name":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xingyu","family":"Liu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7445-9103","authenticated-orcid":false,"given":"Lingyun","family":"Ying","sequence":"additional","affiliation":[{"name":"QIANXIN Technology Research Institute, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9886-1412","authenticated-orcid":false,"given":"Xiaosong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3365001"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-99136-8_3"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.3390\/sym14040718"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2019.01.003"},{"key":"ref5","article-title":"Alibaba group","year":"2023"},{"key":"ref6","article-title":"Alipay","year":"2023"},{"key":"ref7","article-title":"Taobao","year":"2023"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3041008.3041010"},{"key":"ref9","article-title":"Androguard","year":"2023"},{"key":"ref10","article-title":"Att&ck\/t1633.001","year":"2023"},{"key":"ref11","article-title":"BlueStacks","year":"2023"},{"key":"ref12","article-title":"VirusTotal","year":"2023"},{"key":"ref13","article-title":"contagio mobile","year":"2023"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3203422.3203427"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-023-00378-w"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2020.2976559"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2542095.2542107"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2089125.2089126"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2022.102452"},{"key":"ref20","article-title":"maldroid-2020","year":"2023"},{"key":"ref21","article-title":"FRIDA: A world-class dynamic instrumentation toolkit","year":"2025"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2799979.2800004"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102550"},{"key":"ref24","article-title":"Android studio emulator","year":"2023"},{"key":"ref25","article-title":"Android NDK","year":"2023"},{"key":"ref26","article-title":"Android open source project","year":"2023"},{"key":"ref27","article-title":"Android runtime (ART)","year":"2023"},{"key":"ref28","article-title":"Google pixel 2","year":"2023"},{"key":"ref29","article-title":"Android developer document","year":"2023"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134647"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ISDFS60797.2024.10527282"},{"key":"ref32","article-title":"IDA","year":"2023"},{"key":"ref33","article-title":"hybird analysis","year":"2023"},{"key":"ref34","article-title":"Intel bridge technology","year":"2023"},{"key":"ref35","first-page":"106","article-title":"malWASH: Washing malware to evade dynamic analysis","volume-title":"Proc. 10th USENIX Workshop Offensive Technol.","author":"Ispoglou","year":"2016"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.02.005"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664250"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.41"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/1655148.1655151"},{"key":"ref40","first-page":"287","article-title":"BareCloud: Bare-metal analysis-based evasive malware detection","volume-title":"Proc. 23rd USENIX Secur. Symp.","author":"Kirat","year":"2014"},{"key":"ref41","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2022.23056","article-title":"The droid is in the details: Environment-aware evasion of Android sandboxes","volume-title":"Proc. 29th Annu. Netw. Distrib. Syst. Secur. Symp.","author":"Kondracki","year":"2022"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93524-9_9"},{"key":"ref43","article-title":"Leidian emulator","year":"2023"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE62328.2024.00028"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23644-0_18"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2017.8038419"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102613"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/s10922-021-09634-4"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00094"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-024-60982-y"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2015.05.001"},{"key":"ref52","article-title":"Guess where i am, the detection and solution of Android emulator evasion","year":"2023"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.42"},{"key":"ref54","article-title":"Mobsf","year":"2023"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/2818000.2818036"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2025.3551152"},{"key":"ref57","article-title":"Nox emulator","year":"2023"},{"key":"ref58","first-page":"1","article-title":"A fistful of red-pills: How to automatically generate procedures to detect CPU emulators","volume-title":"Proc. 3rd USENIX Workshop Offensive Technol.","author":"Paleari","year":"2009"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/2592791.2592796"},{"key":"ref60","article-title":"Qianxin sandbox","year":"2025"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-75496-1_1"},{"key":"ref62","doi-asserted-by":"crossref","DOI":"10.14722\/ndss.2016.23066","article-title":"Harvesting runtime values in Android applications that feature anti-analysis techniques","volume-title":"Proc. 23rd Annu. Netw. Distrib. Syst. Secur. Symp.","author":"Rasthofer","year":"2016"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3637658"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_1"},{"key":"ref65","article-title":"Android emulator detection system combing","year":"2023"},{"key":"ref66","article-title":"Habo","year":"2023"},{"key":"ref67","article-title":"Triage","year":"2023"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/2590296.2590325"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464828"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3134600.3134601"},{"key":"ref71","article-title":"Xposed framework API","year":"2025"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2025.3552426"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45719-2_8"},{"key":"ref74","article-title":"The police destroyed a large-scale \u201cInternet water army\u201d criminal gang that used software to manipulate hundreds of accounts to forward and like in batches","author":"Yu","year":"2025"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104262"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/11434575\/11230837.pdf?arnumber=11230837","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,17]],"date-time":"2026-03-17T01:15:51Z","timestamp":1773710151000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11230837\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":75,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2025.3629678","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}