{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,19]],"date-time":"2025-12-19T07:09:55Z","timestamp":1766128195495,"version":"3.48.0"},"reference-count":70,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Hong Kong RGC Project","award":["PolyU15224121"],"award-info":[{"award-number":["PolyU15224121"]}]},{"name":"Hong Kong RGC Project","award":["PolyU15231223"],"award-info":[{"award-number":["PolyU15231223"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62232014"],"award-info":[{"award-number":["62232014"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272377"],"award-info":[{"award-number":["62272377"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62202405"],"award-info":[{"award-number":["62202405"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2025.3639962","type":"journal-article","created":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T18:39:35Z","timestamp":1765219175000},"page":"13296-13311","source":"Crossref","is-referenced-by-count":0,"title":["Interpretable Defense Against Structural Adversarial Attacks on Android Malware Detection"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-0836-877X","authenticated-orcid":false,"given":"Wenying","family":"Wei","sequence":"first","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3102-7498","authenticated-orcid":false,"given":"Kaifa","family":"Zhao","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8890-9208","authenticated-orcid":false,"given":"Hao","family":"Zhou","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3453-0195","authenticated-orcid":false,"given":"Jianfeng","family":"Li","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, China"}]},{"given":"Shuohan","family":"Wu","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9327-0987","authenticated-orcid":false,"given":"Ming","family":"Fan","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9082-3208","authenticated-orcid":false,"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4927-5833","authenticated-orcid":false,"given":"Ting","family":"Wang","sequence":"additional","affiliation":[{"name":"Stony Brook, NY, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1383-2765","authenticated-orcid":false,"given":"Kai","family":"Zhou","sequence":"additional","affiliation":[{"name":"Department of Computing, The Hong Kong Polytechnic University, Hong Kong, SAR, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7600-0934","authenticated-orcid":false,"given":"Ting","family":"Liu","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8911-106X","authenticated-orcid":false,"given":"Yuzhe","family":"Tang","sequence":"additional","affiliation":[{"name":"Syracuse University, Syracuse, NY, USA"}]}],"member":"263","reference":[{"volume-title":"Cumulative Detections of Newly-Developed Malware Applications Worldwide","year":"2020","key":"ref1"},{"volume-title":"Annual Number of Malware Attacks Worldwide From 2015 to First Half 2022","year":"2022","key":"ref2"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2016.2536605"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/576"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2019.00023"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23353"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417291"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2014.2353996"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1016\/j.softx.2020.100403"},{"key":"ref11","article-title":"Explaining and harnessing adversarial examples","author":"Goodfellow","year":"2014","journal-title":"arXiv:1412.6572"},{"key":"ref12","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref13","first-page":"3353","article-title":"Adversarial training for free!","volume-title":"Proc. NeurIPS","volume":"32","author":"Shafahi"},{"key":"ref14","first-page":"11192","article-title":"Unlabeled data improves adversarial robustness","volume-title":"Proc. 33rd Int. Conf. Neural Inf. Process. Syst.","author":"Carmon"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00078"},{"key":"ref16","article-title":"Towards making deep learning-based vulnerability detectors robust","author":"Li","year":"2021","journal-title":"arXiv:2108.00669"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3357384.3357875"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-021-01393-7"},{"key":"ref19","article-title":"Transferring adversarial robustness through robust representation matching","author":"Vaishnavi","year":"2022","journal-title":"arXiv:2202.09994"},{"key":"ref20","article-title":"Defending against adversarial malware attacks on ML-based Android malware detection systems","author":"He","year":"2025","journal-title":"arXiv:2501.13782"},{"issue":"1","key":"ref21","first-page":"2","article-title":"A comparative study on optimization, obfuscation, and deobfuscation tools in Android","volume":"11","author":"You","year":"2021","journal-title":"J. Internet Serv. Inf. Secur."},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.4218\/etrij.15.0114.0036"},{"issue":"1","key":"ref23","first-page":"61","article-title":"Membership inference attack against differentially private deep learning model","volume":"11","author":"Rahman","year":"2018","journal-title":"Trans. Data Priv."},{"key":"ref24","article-title":"Evaluation of inference attack models for deep learning on medical data","author":"Wu","year":"2020","journal-title":"arXiv:2011.00177"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/N16-3020"},{"key":"ref26","first-page":"9240","article-title":"GNNExplainer: Generating explanations for graph neural networks","volume-title":"Proc. NeurIPS","author":"Ying"},{"key":"ref27","first-page":"19620","article-title":"Parameterized explainer for graph neural network","volume-title":"Proc. NIPS","volume":"33","author":"Luo"},{"key":"ref28","first-page":"4768","article-title":"A unified approach to interpreting model predictions","volume-title":"Proc. 31st Int. Conf. Neural Inf. Process. Syst.","author":"Lundberg"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382222"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133978"},{"key":"ref31","first-page":"321","article-title":"Why do adversarial attacks transfer? Explaining transferability of evasion and poisoning attacks","volume-title":"Proc. 28th USENIX Secur.","author":"Demontis"},{"key":"ref32","article-title":"EvadeDroid: A practical evasion attack on machine learning for black-box Android malware detection","author":"Bostani","year":"2021","journal-title":"arXiv:2110.03301"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2932228"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485387"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.20"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00073"},{"key":"ref37","first-page":"1181","article-title":"Black-box adversarial example attack towards $FCG$ based Android malware detection under incomplete feature information","volume-title":"Proc. USENIX Secur.","author":"Li"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/2666356.2594299"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623117"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3561048"},{"key":"ref41","first-page":"15","article-title":"Degree-based stratification of nodes in graph neural networks","volume-title":"Proc. Asian Conf. Mach. Learn.","author":"Ali"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3293882.3339001"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3447548.3467416"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3092703.3092719"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2133601.2133640"},{"key":"ref46","first-page":"1","article-title":"Fuzzy hashing for digital forensic investigators","author":"Hurlbut","year":"2009"},{"key":"ref47","first-page":"3319","article-title":"Axiomatic attribution for deep networks","volume-title":"Proc. Int. Conf. Mach. Learn.","volume":"70","author":"Sundararajan"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2017.74"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3265665"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3302509"},{"key":"ref51","first-page":"331","article-title":"MaskDroid: Robust Android malware detection with masked graph representations","volume-title":"Proc. 39th IEEE\/ACM Int. Conf. Automated Softw. Eng.","author":"Zheng"},{"key":"ref52","first-page":"468","article-title":"AndroZoo: Collecting millions of Android apps for the research community","volume-title":"Proc. 13th Int. Conf. Mining Softw. Repositories","author":"Allix"},{"volume-title":"Virustotal","year":"2022","key":"ref53"},{"key":"ref54","first-page":"2361","article-title":"Measuring and modeling the label dynamics of online $Anti-Malware$ engines","volume-title":"Proc. USENIX Secur.","author":"Zhu"},{"key":"ref55","first-page":"181","article-title":"Symbolic execution with $SymCC$: Don\u2019t interpret, compile!","volume-title":"Proc. USENIX Secur.","author":"Poeplau"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.3003571"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3375627.3375830"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013681"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/3375627.3375833"},{"key":"ref60","first-page":"1659","article-title":"Interpretable deep learning under fire","volume-title":"Proc. 29th USENIX Secur. Symp.","author":"Zhang"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE55515.2023.00056"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-20248-8_15"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2017.2700270"},{"key":"ref64","article-title":"Enhancing robustness of deep neural networks against adversarial malware samples: Principles, framework, and AICS\u20192019 challenge","author":"Li","year":"2018","journal-title":"arXiv:1812.08108"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SANER56733.2023.00065"},{"article-title":"Interpreting graph neural networks for NLP with differentiable edge masking","volume-title":"Proc. ICLR","author":"Schlichtkrull","key":"ref66"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/tkde.2022.3187455"},{"key":"ref68","first-page":"12225","article-title":"PGM-explainer: Probabilistic graphical model explanations for graph neural networks","volume-title":"Proc. NeurIPS","volume":"33","author":"Vu"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484589"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/DSN53405.2022.00028"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/11284777.pdf?arnumber=11284777","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,19]],"date-time":"2025-12-19T07:05:56Z","timestamp":1766127956000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11284777\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":70,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3639962","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"type":"print","value":"1556-6013"},{"type":"electronic","value":"1556-6021"}],"subject":[],"published":{"date-parts":[[2025]]}}}