Panagiotis Andriotis

Essam Ghadafi, Panagiotis Andriotis

The rise of social media financial influencers (finfluencers) has transformed how financial information is disseminated to broad and often inexperienced audiences. While these creators may contribute to financial literacy, concerns remain regarding the reliability of their content and the adequacy of risk disclosures. Using data collected through TikTok's Research API, we analyze UK finfluencer content, engagement dynamics, disclaimer practices, audience sentiment, and network structure. The primary dataset comprises 13,215 videos and 104,097 comments posted by 71 UK-based finfluencers between April and September 2024, while a follow-up dataset covering October 2025 to March 2026 enables longitudinal analysis of disclaimer practices, engagement trends, and hashtag usage. Using topic modeling, we identify four dominant themes: Entrepreneurship \& Side Hustles, Property Investing, Active Trading, and Saving \& Budgeting. Sentiment analysis of audience comments reveals predominantly neutral-to-positive responses, while engagement analysis shows only a negligible association between video duration and engagement rate. Social network analysis indicates a collaborative ecosystem in which mid-tier finfluencers frequently act as bridges between creator groups. Explicit disclaimers and risk-related language remain relatively uncommon overall and are concentrated primarily in trading-related content. The findings highlight challenges related to financial transparency and disclosure practices within short-form financial content ecosystems. We discuss implications for consumer protection and the design of clearer and more standardized financial risk disclosures on social media platforms.

Lucky Onwuzurike, Enrico Mariconti, Panagiotis Andriotis et al.

As Android has become increasingly popular, so has malware targeting it, thus pushing the research community to propose different detection techniques. However, the constant evolution of the Android ecosystem, and of malware itself, makes it hard to design robust tools that can operate for long periods of time without the need for modifications or costly re-training. Aiming to address this issue, we set to detect malware from a behavioral point of view, modeled as the sequence of abstracted API calls. We introduce MaMaDroid, a static-analysis based system that abstracts the API calls performed by an app to their class, package, or family, and builds a model from their sequences obtained from the call graph of an app as Markov chains. This ensures that the model is more resilient to API changes and the features set is of manageable size. We evaluate MaMaDroid using a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it effectively detects malware (with up to 0.99 F-measure) and keeps its detection capabilities for long periods of time (up to 0.87 F-measure two years after training). We also show that MaMaDroid remarkably outperforms DroidAPIMiner, a state-of-the-art detection system that relies on the frequency of (raw) API calls. Aiming to assess whether MaMaDroid's effectiveness mainly stems from the API abstraction or from the sequencing modeling, we also evaluate a variant of it that uses frequency (instead of sequences), of abstracted API calls. We find that it is not as accurate, failing to capture maliciousness when trained on malware samples that include API calls that are equally or more frequently used by benign apps.

Enrico Mariconti, Lucky Onwuzurike, Panagiotis Andriotis et al.

The rise in popularity of the Android platform has resulted in an explosion of malware threats targeting it. As both Android malware and the operating system itself constantly evolve, it is very challenging to design robust malware mitigation techniques that can operate for long periods of time without the need for modifications or costly re-training. In this paper, we present MaMaDroid, an Android malware detection system that relies on app behavior. MaMaDroid builds a behavioral model, in the form of a Markov chain, from the sequence of abstracted API calls performed by an app, and uses it to extract features and perform classification. By abstracting calls to their packages or families, MaMaDroid maintains resilience to API changes and keeps the feature set size manageable. We evaluate its accuracy on a dataset of 8.5K benign and 35.5K malicious apps collected over a period of six years, showing that it not only effectively detects malware (with up to 99% F-measure), but also that the model built by the system keeps its detection capabilities for long periods of time (on average, 86% and 75% F-measure, respectively, one and two years after training). Finally, we compare against DroidAPIMiner, a state-of-the-art system that relies on the frequency of API calls performed by apps, showing that MaMaDroid significantly outperforms it.