通过界面与行为对齐，精准发现隐藏的手机恶意软件。
UIXPOSE: Mobile Malware Detection via Intention-Behaviour Discrepancy Analysis
- 用视觉语言模型从界面推断意图向量
- 运行时比对意图与行为，识别隐蔽异常
- 适合研究移动安全与动态检测的开发者
我们提出UIXPOSE，一种不依赖源代码的框架，适用于编译后和开源应用。该框架采用意图-行为对齐（IBA）进行移动端恶意软件分析，将界面推断的意图与运行时语义对齐。以往工作要么静态推断意图（如基于权限），要么监测粗粒度动态信号（端点、部分资源使用），难以捕捉内容与上下文。UIXPOSE利用视觉语言模型和知识结构，从每屏推断意图向量，并融合解码的网络负载、堆/内存信号及资源使用轨迹生成行为向量。在运行时计算二者对齐度，既能检测异常行为，也能揭示行为丰富路径的探索。三个真实案例表明，UIXPOSE发现隐蔽数据外泄与后台活动，这些行为逃过了仅依赖元数据的基线方法，证明了IBA在动态检测中的优势。
原文摘要 · Abstract (English)
We introduce UIXPOSE, a source-code-agnostic framework that operates on both compiled and open-source apps. This framework applies Intention Behaviour Alignment (IBA) to mobile malware analysis, aligning UI-inferred intent with runtime semantics. Previous work either infers intent statically, e.g., permission-centric, or widget-level or monitors coarse dynamic signals (endpoints, partial resource usage) that miss content and context. UIXPOSE infers an intent vector from each screen using vision-language models and knowledge structures and combines decoded network payloads, heap/memory signals, and resource utilisation traces into a behaviour vector. Their alignment, calculated at runtime, can both detect misbehaviour and highlight exploration of behaviourally rich paths. In three real-world case studies, UIXPOSE reveals covert exfiltration and hidden background activity that evade metadata-only baselines, demonstrating how IBA improves dynamic detection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。