{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,10]],"date-time":"2026-06-10T02:52:08Z","timestamp":1781059928955,"version":"3.54.1"},"reference-count":56,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Key Research and Development Program of China","award":["2022YFF0604503"],"award-info":[{"award-number":["2022YFF0604503"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272215"],"award-info":[{"award-number":["62272215"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272224"],"award-info":[{"award-number":["62272224"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62302207"],"award-info":[{"award-number":["62302207"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62341201"],"award-info":[{"award-number":["62341201"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Leading Edge Technology Program of the Jiangsu Natural Science Foundation","award":["BK20202001"],"award-info":[{"award-number":["BK20202001"]}]},{"name":"Science Foundation for Youths of Jiangsu Province","award":["BK20220772"],"award-info":[{"award-number":["BK20220772"]}]},{"name":"NSF","award":["OAC-2115167"],"award-info":[{"award-number":["OAC-2115167"]}]},{"name":"DARPA Cooperative Agreement","award":["HR00112120009"],"award-info":[{"award-number":["HR00112120009"]}]},{"name":"Battelle Energy Alliance, LLC","award":["313367"],"award-info":[{"award-number":["313367"]}]},{"name":"Cisco"},{"name":"Stellar Development Foundation"},{"name":"Singapore Ministry of Education (MoE) Tier 1 Academic Research Fund","award":["22-SIS-SMU-089"],"award-info":[{"award-number":["22-SIS-SMU-089"]}]},{"DOI":"10.13039\/501100001321","name":"National Research Foundation","doi-asserted-by":"crossref","award":["000748"],"award-info":[{"award-number":["000748"]}],"id":[{"id":"10.13039\/501100001321","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3550049","type":"journal-article","created":{"date-parts":[[2025,3,10]],"date-time":"2025-03-10T17:34:41Z","timestamp":1741628081000},"page":"3689-3704","source":"Crossref","is-referenced-by-count":4,"title":["DeepVMUnProtect: Neural Network-Based Recovery of VM-Protected Android Apps for Semantics-Aware Malware Detection"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-9336-1880","authenticated-orcid":false,"given":"Xin","family":"Zhao","sequence":"first","affiliation":[{"name":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mu","family":"Zhang","sequence":"additional","affiliation":[{"name":"Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-0039-4013","authenticated-orcid":false,"given":"Xiaopeng","family":"Ke","sequence":"additional","affiliation":[{"name":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-1031-0385","authenticated-orcid":false,"given":"Yu","family":"Pan","sequence":"additional","affiliation":[{"name":"Kahlert School of Computing, University of Utah, Salt Lake City, UT, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yue","family":"Duan","sequence":"additional","affiliation":[{"name":"School of Computing and Information Systems, Singapore Management University, Bras Basah, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6581-8730","authenticated-orcid":false,"given":"Sheng","family":"Zhong","sequence":"additional","affiliation":[{"name":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3388-7544","authenticated-orcid":false,"given":"Fengyuan","family":"Xu","sequence":"additional","affiliation":[{"name":"National Key Laboratory for Novel Software Technology, Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23296"},{"key":"ref2","volume-title":"Android Packed Malware 54525","author":"Web","year":"2024"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-24177-7_15"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-26362-5_17"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.40"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00105"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.20"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660359"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464839"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2009.27"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029823"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37300-8_4"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3029806.3029825"},{"key":"ref14","first-page":"1","article-title":"MaMaDroid: Detecting Android malware by building Markov chains of behavioral models","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Mariconti"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3371924"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3162625"},{"key":"ref17","first-page":"1","article-title":"Going native: Using a large-scale analysis of Android apps to create a practical native-code sandboxing policy","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Afonso"},{"key":"ref18","volume-title":"Dynamic Instrumentation Toolkit for Developers, Reverse-engineers, and Security Researchers","year":"2022"},{"key":"ref19","first-page":"99","article-title":"Neural nets can learn function type signatures from binaries","volume-title":"Proc. 26th USENIX Secur. Symp.","author":"Chua"},{"key":"ref20","first-page":"611","article-title":"Recognizing functions in binaries with neural networks","volume-title":"Proc. 24th USENIX Secur. Symp.","author":"Shin"},{"key":"ref21","first-page":"1787","article-title":"DEEPVSA: Facilitating value-set analysis with deep learning for postmortem program analysis","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Guo"},{"key":"ref22","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov","year":"2013","journal-title":"arXiv:1301.3781"},{"key":"ref23","volume-title":"The Lldb Debugger","year":"2022"},{"key":"ref24","volume-title":"From Research to Production","year":"2022"},{"key":"ref25","volume-title":"Baidu Mobile Platfrom","year":"2022"},{"key":"ref26","volume-title":"Ijiami","year":"2022"},{"key":"ref27","volume-title":"Bangcle","year":"2022"},{"key":"ref28","volume-title":"Nmmp Packer","year":"2023"},{"key":"ref29","volume-title":"Anzhi","year":"2022"},{"key":"ref30","volume-title":"Baidu App Store","year":"2022"},{"key":"ref31","volume-title":"Xiaomi App Store","year":"2022"},{"key":"ref32","volume-title":"360 App Store","year":"2022"},{"key":"ref33","volume-title":"Android Packer Identifier","year":"2023"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2018.8585560"},{"key":"ref35","volume-title":"Android Malware Genome Project","author":"Zhou","year":"2015"},{"key":"ref36","volume-title":"Deep Android Malware Detection","year":"2022"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/dasc-picom-cbdcom-cyberscitech49142.2020.00094"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/s10922-021-09634-4"},{"key":"ref39","volume-title":"Virustotal","year":"2024"},{"key":"ref40","volume-title":"Malware Bazaar Detector","year":"2024"},{"key":"ref41","volume-title":"Github Repo of NMMP","year":"2024"},{"key":"ref42","volume-title":"Qihoo VM Packed Malware","year":"2024"},{"key":"ref43","volume-title":"Nmmp Vm Packed Malware","year":"2024"},{"key":"ref44","volume-title":"Virustotal Report on Qihoo Vm Packed Malware","year":"2024"},{"key":"ref45","volume-title":"Virustotal Report on Nmmp Vm Packed Malware","year":"2024"},{"key":"ref46","first-page":"1","article-title":"Chosen-instruction attack against commercial code virtualization obfuscators","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Li"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2242890"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2866319"},{"key":"ref49","doi-asserted-by":"crossref","first-page":"871","DOI":"10.1016\/j.cose.2018.04.005","article-title":"Malware identification using visualization images and deep learning","volume":"77","author":"Ni","year":"2018","journal-title":"Comput. Secur."},{"key":"ref50","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.101740","article-title":"Byte-level malware classification based on Markov images and deep learning","volume":"92","author":"Yuan","year":"2020","journal-title":"Comput. Secur."},{"key":"ref51","doi-asserted-by":"crossref","first-page":"212","DOI":"10.1016\/j.cose.2014.10.011","article-title":"A framework for metamorphic malware analysis and real-time detection","volume":"48","author":"Alam","year":"2015","journal-title":"Comput. Secur."},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2020.3015584"},{"key":"ref53","first-page":"1","article-title":"Unpacking virtualization obfuscators","volume-title":"Proc. WOOT","author":"Rolles"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046739"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.47"},{"key":"ref56","first-page":"643","article-title":"Syntia: Synthesizing the semantics of obfuscated code","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Secur.)","author":"Blazytko"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10919157.pdf?arnumber=10919157","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,7]],"date-time":"2025-04-07T20:48:31Z","timestamp":1744058911000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10919157\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":56,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3550049","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}