一句话：提出以实体及其交互来源刻画移动应用行为的静态分析方法 EnMobile，用于签名式恶意软件检测，精度与召回率显著优于四种已有方法。
现代移动恶意软件往往通过涉及多实体（移动平台、用户、网络位置等）的复杂交互实施恶意行为，已有检测方法因刻画表达能力与准确性有限而难以识别。本文提出 EnMobile：将应用所处环境中的实体、应用与这些实体的交互、以及交互的来源（即每次交互的意图与归属）视为全面刻画现代移动应用（尤其是恶意软件）的关键，据此给出一种全新的基于实体的应用行为刻画方式，并设计相应的静态分析以准确刻画应用与实体的交互。作者实现了 EnMobile，并将其应用于基于签名的移动恶意软件检测方案。在由 Genome 与 Drebin 恶意应用及 Google Play 良性应用构成的 6614 个应用集合上评估，结果显示 EnMobile 的检测精度与召回率大幅优于 Apposcopy、Drebin、MUDFLOW 和 AppContext 四种代表性方法。
Modern mobile malware tend to conduct their malicious exploits through sophisticated patterns of interactions that involve multiple entities, e.g., the mobile platform, human users, and network locations. Such malware often evade the detection by existing approaches due to their limited expressiveness and accuracy in characterizing and detecting these malware. To address these issues, in this paper, we recognize entities in the environment of an app, the app's interactions with such entities, and the provenance of these interactions, i.e., the intent and ownership of each interaction, as the key to comprehensively characterizing modern mobile apps, and mobile malware in particular. With this insight, we propose a novel approach named EnMobile including a new entity-based characterization of mobile-app behaviors, and corresponding static analyses, to accurately characterize an app's interactions with entities. We implement EnMobile and provide a practical application of EnMobile in a signature-based scheme for detecting mobile malware. We evaluate EnMobile on a set of 6614 apps consisting of malware from Genome and Drebin along with benign apps from Google Play. Our results show that EnMobile detects malware with substantially higher precision and recall than four state-of-the-art approaches, namely Apposcopy, Drebin, MUDFLOW, and AppContext.