Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

BinCtx: Multi-Modal Representation Learning for Robust Android App Behavior Detection

Zichen Liu, Shao Yang, Xusheng Xiao

TL;DR

BinCtx tackles the challenge of detecting malicious and undesired Android app behaviors that are not strictly tied to dangerous permissions. It constructs a three-branch representation by (i) rendering the DEX bytecode as an RGB image processed by DenseNet, (ii) extracting contextual signals from AndroidManifest.xml and URL/IP constants, and (iii) counting third-party library usage via Inter-Component Call Graph paths, all fused into a multi-layer perceptron classifier. The approach achieves a macro $F_1$ of $94.73\%$, surpassing state-of-the-art baselines by at least $14.92\%$, and shows robustness to code obfuscation and adversarial manipulation. These results demonstrate the value of integrating global code textures with contextual and SDK-usage signals for reliable detection, with practical implications for app-market vetting and policy enforcement.

Abstract

Mobile app markets host millions of apps, yet undesired behaviors (e.g., disruptive ads, illegal redirection, payment deception) remain hard to catch because they often do not rely on permission-protected APIs and can be easily camouflaged via UI or metadata edits. We present BINCTX, a learning approach that builds multi-modal representations of an app from (i) a global bytecode-as-image view that captures code-level semantics and family-style patterns, (ii) a contextual view (manifested actions, components, declared permissions, URL/IP constants) indicating how behaviors are triggered, and (iii) a third-party-library usage view summarizing invocation frequencies along inter-component call paths. The three views are embedded and fused to train a contextual-aware classifier. On real-world malware and benign apps, BINCTX attains a macro F1 of 94.73%, outperforming strong baselines by at least 14.92%. It remains robust under commercial obfuscation (F1 84% post-obfuscation) and is more resistant to adversarial samples than state-of-the-art bytecode-only systems.

BinCtx: Multi-Modal Representation Learning for Robust Android App Behavior Detection

TL;DR

BinCtx tackles the challenge of detecting malicious and undesired Android app behaviors that are not strictly tied to dangerous permissions. It constructs a three-branch representation by (i) rendering the DEX bytecode as an RGB image processed by DenseNet, (ii) extracting contextual signals from AndroidManifest.xml and URL/IP constants, and (iii) counting third-party library usage via Inter-Component Call Graph paths, all fused into a multi-layer perceptron classifier. The approach achieves a macro of , surpassing state-of-the-art baselines by at least , and shows robustness to code obfuscation and adversarial manipulation. These results demonstrate the value of integrating global code textures with contextual and SDK-usage signals for reliable detection, with practical implications for app-market vetting and policy enforcement.

Abstract

Mobile app markets host millions of apps, yet undesired behaviors (e.g., disruptive ads, illegal redirection, payment deception) remain hard to catch because they often do not rely on permission-protected APIs and can be easily camouflaged via UI or metadata edits. We present BINCTX, a learning approach that builds multi-modal representations of an app from (i) a global bytecode-as-image view that captures code-level semantics and family-style patterns, (ii) a contextual view (manifested actions, components, declared permissions, URL/IP constants) indicating how behaviors are triggered, and (iii) a third-party-library usage view summarizing invocation frequencies along inter-component call paths. The three views are embedded and fused to train a contextual-aware classifier. On real-world malware and benign apps, BINCTX attains a macro F1 of 94.73%, outperforming strong baselines by at least 14.92%. It remains robust under commercial obfuscation (F1 84% post-obfuscation) and is more resistant to adversarial samples than state-of-the-art bytecode-only systems.
Paper Structure (21 sections, 3 equations, 6 figures, 5 tables)

This paper contains 21 sections, 3 equations, 6 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Background and Motivation
  3. Approach
  4. Overview
  5. Bytecode Representation Extraction
  6. Contextual Information Extraction
  7. Third Party Library Extraction
  8. Model Architecture and Training
  9. Evaluation
  10. Experimental Setup
  11. Datasets and Pre-processing.
  12. Implementation Details and Hyperparameters.
  13. Baselines for Comparison.
  14. RQ1: Overall Performance
  15. Qualitative and Error Analysis.
  16. ...and 6 more sections

Figures (6)

  • Figure 1: (a) Structure of an Android bytecode file (classes.dex). (b)–(c) Fusob (ransomware) samples: similar fine-grained diagonal textures and stripe clusters, illustrating strong intra-family regularity. (d)–(e) Mecor (potentially unwanted app (PUA)) samples: broader high-contrast vertical bands with fewer diagonal artifacts, distinct from Fusob yet consistent within the family.
  • Figure 1: Final Dataset Composition
  • Figure 2: Overview of the BinCtx framework.
  • Figure 3: Overview of Contextual-Aware Undesired Behavior Model
  • Figure 4: DEX-as-image: ad disruption vs. benign.
  • ...and 1 more figures