mlsanityData to 7 Oct 2026

UIXPOSE: Mobile Malware Detection via Intention-Behaviour Discrepancy Analysis

arXiv 2512.14130 ↗First posted 16 Dec 2025cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

We introduce UIXPOSE, a source-code-agnostic framework that operates on both compiled and open-source apps. This framework applies Intention Behaviour Alignment (IBA) to mobile malware analysis, aligning UI-inferred intent with runtime semantics. Previous work either infers intent statically, e.g., permission-centric, or widget-level or monitors coarse dynamic signals (endpoints, partial resource usage) that miss content and context. UIXPOSE infers an intent vector from each screen using vision-language models and knowledge structures and combines decoded network payloads, heap/memory signals, and resource utilisation traces into a behaviour vector. Their alignment, calculated at runtime, can both detect misbehaviour and highlight exploration of behaviourally rich paths. In three real-world case studies, UIXPOSE reveals covert exfiltration and hidden background activity that evade metadata-only baselines, demonstrating how IBA improves dynamic detection.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 9 of its 44 references that are in the map. First posted on arXiv 16 Dec 2025.

Builds on

9 of 44 references.

References · 9

  1. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  2. 2021Screen2Words: Automatic Mobile UI Summarization with Multimodal Learningcited by 119
  3. 2018TESSERACT: Eliminating Experimental Bias in Malware Classification across Space and Timecited by 108
  4. 2023Make LLM a Testing Expert: Bringing Human-like Interaction to Mobile GUI Testing via Functionality-aware Decisionscited by 41
  5. 2023Prompting Is All You Need: Automated Android Bug Replay with Large Language Modelscited by 40
  6. 2025LLM-Powered GUI Agents in Phone Automation: Surveying Progress and Prospectscited by 31
  7. 2024AppPoet: Large Language Model based Android malware detection via multi-view prompt engineeringcited by 16
  8. 2025A Contemporary Survey of Large Language Model Assisted Program Analysiscited by 10
  9. 2022DroidRL: Reinforcement Learning Driven Feature Selection for Android Malware Detectioncited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection
  2. 2025TraceRAG: A LLM-Based Framework for Explainable Android Malware Detection and Behavior Analysis
  3. 2026Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning
  4. 2025LAMD: Context-driven Android Malware Detection and Classification with LLMs
  5. 2026MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes
  6. 2025Enhancing Android Malware Detection with Retrieval-Augmented Generation
  7. 2025DroidTTP: Mapping Android Applications with TTP for Cyber Threat Intelligence
  8. 2026MARD: A Multi-Agent Framework for Robust Android Malware Detection