{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,12]],"date-time":"2025-10-12T04:11:01Z","timestamp":1760242261024,"version":"build-2065373602"},"reference-count":34,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2017,2,11]],"date-time":"2017-02-11T00:00:00Z","timestamp":1486771200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"the Foundation of Educational Commission of Tianjin, China","award":["20130801"],"award-info":[{"award-number":["20130801"]}]},{"name":"the General Project of Tianjin Municipal Science and Technology Commission","award":["15JCYBJC15600"],"award-info":[{"award-number":["15JCYBJC15600"]}]},{"name":"the Major Project of Tianjin Municipal Science and Technology Commission","award":["15ZXDSGX00030"],"award-info":[{"award-number":["15ZXDSGX00030"]}]},{"name":"NSFC: The United Foundation of General Technology and Fundamental Research","award":["U1536122"],"award-info":[{"award-number":["U1536122"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Recently, Android malicious code has increased dramatically and the technology of reinforcement is increasingly powerful. Due to the development of code obfuscation and polymorphic deformation technology, the current Android malicious code static detection method whose feature selected is the semantic of application source code can not completely extract malware\u2019s code features. The Android malware static detection methods whose features used are only obtained from the AndroidManifest.xml file are easily affected by useless permissions. Therefore, there are some limitations in current Android malware static detection methods. The current Android malware dynamic detection algorithm is mostly required to customize the system or needs system root permissions. Based on the Dendritic Cell Algorithm (DCA), this paper proposes an Android malware algorithm that has a higher detection rate, does not need to modify the system, and reduces the impact of code obfuscation to a certain degree. This algorithm is applied to an Android malware detection method based on oriented Dalvik disassembly sequence and application interface (API) calling sequence. Through the designed experiments, the effectiveness of this method is verified for the detection of Android malware.<\/jats:p>","DOI":"10.3390\/e19020065","type":"journal-article","created":{"date-parts":[[2017,2,15]],"date-time":"2017-02-15T10:09:07Z","timestamp":1487153347000},"page":"65","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["An Android Malicious Code Detection Method Based on Improved DCA Algorithm"],"prefix":"10.3390","volume":"19","author":[{"given":"Chundong","family":"Wang","sequence":"first","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiyuan","family":"Li","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6124-2458","authenticated-orcid":false,"given":"Liangyi","family":"Gong","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiuliang","family":"Mo","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hong","family":"Yang","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yi","family":"Zhao","sequence":"additional","affiliation":[{"name":"Key Laboratory of Computer Vision and System, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"},{"name":"Tianjin Key Laboratory of Intelligence Computing and Novel Software Technology, Ministry of Education, Tianjin University of Technology, 300384 Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2017,2,11]]},"reference":[{"key":"ref_1","unstructured":"Statista. Available online: https:\/\/www.statista.com\/statistics\/266136\/global-market-share-held-by-smartphone-operating-systems\/."},{"key":"ref_2","unstructured":"AVL. Available online: http:\/\/blog.avlyun.com\/2016\/02\/2759\/2015report\/."},{"key":"ref_3","unstructured":"Shangguan, L., Yang, Z., Liu, A.X., Zhou, Z., and Liu, Y. (2015, January 4\u20136). Relative localization of RFID tags using spatial-temporal phase profiling. Proceedings of the 12th USENIX Symposium on Networked Systems Design and Implementation (NSDI 15th), Oakland, CA, USA."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"43","DOI":"10.1016\/j.jnca.2013.05.008","article-title":"Detecting mobile malware threats to homeland security through static analysis","volume":"38","author":"Seo","year":"2014","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_5","unstructured":"Shabtai, A., Fledel, Y., Kanonov, U., Elovici, Y., and Dolev, S. (arXiv, 2009). Google android: A state-of-the-art review of security mechanisms, arXiv."},{"key":"ref_6","first-page":"45","article-title":"Research Progress on Android Security","volume":"27","year":"2016","journal-title":"J. Softw."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Enck, W., Ongtang, M., and McDaniel, P. (2009, January 9\u201313). On lightweight mobile phone application certification. Proceedings of the 16th ACM Conference on Computer and Communications Security, Chicago, IL, USA.","DOI":"10.1145\/1653662.1653691"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"658","DOI":"10.1002\/sec.360","article-title":"Semantically rich application-centric security in Android","volume":"5","author":"Ongtang","year":"2012","journal-title":"Secur. Commun. Netw."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Nauman, M., Khan, S., and Zhang, X. (2010, January 13\u201316). Apex: Extending android permission model and enforcement with user-defined runtime constraints. Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security, Beijing, China.","DOI":"10.1145\/1755688.1755732"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"25","DOI":"10.1016\/j.scico.2013.11.037","article-title":"Formalisation and analysis of Dalvik bytecode","volume":"92","author":"Wognsen","year":"2014","journal-title":"Sci. Comput. Programm."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Sarma, B.P., Li, N., Gates, C., Potharaju, R., Nita-Rotaru, C., and Molloy, I. (2012, January 20\u201322). Android permissions: A perspective combining risks and benefits. Proceedings of the ACM Symposium on Access Control Models & Technologies Ser Sacmat, Newark, NJ, USA.","DOI":"10.1145\/2295136.2295141"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"23","DOI":"10.7125\/APAN.36.4","article-title":"Detecting Android malware by analyzing manifest files","volume":"36","author":"Sato","year":"2013","journal-title":"APAN"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Wu, D.J., Mao, C.H., Wei, T.E., Lee, H.M., and Wu, K.P. (2012, January 9\u201310). Droidmat: Android malware detection through manifest and api calls tracing. Proceedings of the 2012 Seventh Asia Joint Conference on Information Security (Asia JCIS), Tokyo, Japan.","DOI":"10.1109\/AsiaJCIS.2012.18"},{"key":"ref_14","unstructured":"Weichselbaum, L., Neugschwandtner, M., Lindorfer, M., Fratantonio, Y., van der Veen, V., and Platzer, C. (2014). Andrubis: Android Malware under the Magnifying Glass, Vienna University of Technology. TR-ISECLAB-0414-001."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Grace, M., Zhou, Y., Zhang, Q., Zou, S., and Jiang, X. (2012, January 25\u201329). Riskranker: Scalable and accurate zero-day android malware detection. Proceedings of the 10th International Conference on Mobile Systems, Applications, and Services, Lake District, UK.","DOI":"10.1145\/2307636.2307663"},{"key":"ref_16","first-page":"1458","article-title":"Description of Android Malware Feature Based on Dalvik Instructions","volume":"7","author":"Li","year":"2014","journal-title":"J. Comput. Res. Dev."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1104","DOI":"10.1016\/j.eswa.2013.07.106","article-title":"Dendroid: A text mining approach to analyzing and classifying code structures in Android malware families","volume":"41","author":"Tapiador","year":"2014","journal-title":"Expert Syst. Appl."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"522","DOI":"10.3724\/SP.J.1001.2011.03727","article-title":"Obfuscated Malware Detection Based on Boosting Multilevel Features","volume":"3","author":"Kong","year":"2011","journal-title":"J. Softw."},{"key":"ref_19","unstructured":"Pektas, A., Eris, M., and Acarman, T. (2011, January 21\u201327). Proposal of n-gram based algorithm for malware classification. Proceedings of the Fifth International Conference on Emerging Security Information, Systems and Technologies, French Riviera, France."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Ng, D.V., and Hwang, J.I.G. (2014, January 13\u201316). Android malware detection using the dendritic cell algorithm. Proceedings of the 2014 International Conference on Machine Learning and Cybernetics (ICMLC), Lanzhou, China.","DOI":"10.1109\/ICMLC.2014.7009126"},{"key":"ref_21","unstructured":"Cesare, S., and Xiang, Y. (2010, January 1). Classification of malware using structured control flow. Proceedings of the Eighth Australasian Symposium on Parallel and Distributed Computing-Volume 107, Brisbane, Australia."},{"key":"ref_22","unstructured":"Li, W.J., Wang, K., Stolfo, S.J., and Herzog, B. (2005, January 15\u201317). Fileprints: Identifying file types by n-gram analysis. Proceedings of the Sixth Annual Workshop on Information Assurance, New York, NY, USA."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"991","DOI":"10.1146\/annurev.iy.12.040194.005015","article-title":"Tolerance, danger, and the extended family","volume":"12","author":"Matzinger","year":"1994","journal-title":"Annu. Rev. Immunol."},{"key":"ref_24","unstructured":"Greensmith, J. (2007). The Dendritic Cell Algorithm. [Ph.D. Thesis, University of Nottingham]."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Sahin, C., Tornquist, P., Mckenna, R., Pearson, Z., and Clause, J. (2016, January 2\u201310). How Does Code Obfuscation Impact Energy Usage?. Proceedings of the IEEE International Conference on Software Maintenance and Evolution, Raleigh, NC, USA.","DOI":"10.1002\/smr.1762"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"998","DOI":"10.1109\/COMST.2014.2386139","article-title":"Android Security: A Survey of Issues, Malware Penetration and Defenses","volume":"17","author":"Faruki","year":"2014","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"457","DOI":"10.1002\/sec.936","article-title":"Server-based code obfuscation scheme for APK tamper detection","volume":"9","author":"Piao","year":"2014","journal-title":"Secur. Commun. Netw."},{"key":"ref_28","unstructured":"Manzoor, S., Shafiq, M.Z., Tabish, S.M., and Farooq, M. (2009). Artificial Immune Systems, Springer."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Rycht\u00e1rikov\u00e1, R., Korbel, J., Mach\u00e1\u010dek, P., C\u00edsa\u0159, P., Urban, J., and \u0160tys, D. (2016). Point Information Gain and Multidimensional Data Analysis. Entropy, 18.","DOI":"10.20944\/preprints201610.0067.v1"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Sung, Y. (2016). Intelligent Security IT System for Detecting Intruders Based on Received Signal Strength Indicators. Entropy, 18.","DOI":"10.3390\/e18100366"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"127","DOI":"10.1016\/j.biosystems.2013.01.001","article-title":"Theoretical formulation and analysis of the deterministic dendritic cell algorithm","volume":"111","author":"Gu","year":"2013","journal-title":"Biosystems"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"2164","DOI":"10.1109\/TAES.2014.120792","article-title":"Simulation and analysis of polarimetric radar signatures of human gaits","volume":"50","author":"Park","year":"2014","journal-title":"IEEE Trans. Aerosp. Electron. Syst."},{"key":"ref_33","unstructured":"Jang, W.Y., Park, J., Fuchs, Z., Parada, F., Hanna, P., Derov, J., and Noyola, M. (2014, January 13\u201318). Multispectral target recognition using adaptive radar and infrared data integration. Proceedings of the 2014 IEEE Geoscience and Remote Sensing Symposium, Quebec City, QC, Canada."},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"1869","DOI":"10.1109\/TIFS.2014.2353996","article-title":"Exploring permission-induced risk in Android applications for malicious application detection","volume":"9","author":"Wang","year":"2014","journal-title":"IEEE Trans. Inf. Forensic Secur."}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/2\/65\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T18:28:03Z","timestamp":1760207283000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/19\/2\/65"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,2,11]]},"references-count":34,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2017,2]]}},"alternative-id":["e19020065"],"URL":"https:\/\/doi.org\/10.3390\/e19020065","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2017,2,11]]}}}