Abstract
Deep learning-based malware detection has been widely adopted in security-critical services. Most detection methods rely on internal features extracted from APK files or runtime behavior. However, extracting these features is computationally expensive. This limits their use in large-scale, early-stage screening. Malicious apps may exhibit weak correspondence between their user-facing app names and package names, providing a low-cost screening signal. We present Name2Pkg, a lightweight one-class classification method. It leverages only the app name and the package name. We formulate malware screening as a sequence anomaly detection problem. A character-level sequence-to-sequence model estimates the conditional likelihood of a package name given the app name. The length-normalized negative log-likelihood serves as the anomaly score. We train the model and calibrate the threshold using only benign data. Using a dataset of 67,129 real-world applications, Name2Pkg achieves an area under the receiver operating characteristic curve (ROC-AUC) of 0.982 and malware recall of 0.885 at an achieved false-positive rate of 0.044 on held-out test data. It has a 3.57 MiB checkpoint and a CPU inference latency of 28.20 ms per sample. Name2Pkg provides an efficient and effective pre-filtering signal for large-scale security systems.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Sung, C., Kang, Y., Shin, J., & Kim, H. K. (2026). Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling. https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling
MLA 9
Sung, Changyeop, et al. "Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling." https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling.
Chicago (author–date)
Sung, Changyeop, Yeonjae Kang, Jaeho Shin, and Huy Kang Kim. 2026. "Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling." https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling.
Harvard
Sung, C., Kang, Y., Shin, J. and Kim, H. K. (2026) 'Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling', Available at: https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling.
Vancouver
Sung C, Kang Y, Shin J, Kim HK. Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling. https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling
IEEE
C. Sung, Y. Kang, J. Shin, and H. K. Kim, "Name2Pkg: Lightweight One-Class Android Malware Screening via Name-Package Correspondence Modeling," https://omanscience.com/en/articles/name2pkg-lightweight-one-class-android-malware-screening-via-name-package-correspondence-modeling.