UIXPOSE: Mobile Malware Detection via Intention-Behaviour Discrepancy Analysis

TL;DR

UIXPOSE is a novel framework that detects mobile malware by analyzing discrepancies between inferred user intent and runtime behavior, using vision-language models and multi-source signals to identify covert malicious activities.

Contribution

It introduces a source-code-agnostic approach employing intention-behavior alignment for dynamic malware detection, surpassing prior static and coarse dynamic analysis methods.

Findings

Detects covert exfiltration and background activity

Reveals malware evading metadata-only baselines

Improves dynamic detection accuracy

Abstract

We introduce UIXPOSE, a source-code-agnostic framework that operates on both compiled and open-source apps. This framework applies Intention Behaviour Alignment (IBA) to mobile malware analysis, aligning UI-inferred intent with runtime semantics. Previous work either infers intent statically, e.g., permission-centric, or widget-level or monitors coarse dynamic signals (endpoints, partial resource usage) that miss content and context. UIXPOSE infers an intent vector from each screen using vision-language models and knowledge structures and combines decoded network payloads, heap/memory signals, and resource utilisation traces into a behaviour vector. Their alignment, calculated at runtime, can both detect misbehaviour and highlight exploration of behaviourally rich paths. In three real-world case studies, UIXPOSE reveals covert exfiltration and hidden background activity that evade metadata-only baselines, demonstrating how IBA improves dynamic detection.