1. Introduction

Smartphones play an essential role in our daily lives. They offer a variety of enticing features that allow mobile users to make use of a variety of high-quality customized services (Ribeiro, Saghezchi, Mantas, Rodriguez, & Abd-Alhameed, 2020). Some of the services provided by smartphones are voice and video communication, e-mail addresses, internet browsing, online shopping, banking, and many other functions (Radoglou-Grammatikis & Sarigiannidis, 2017). Many operating systems are available for smartphone devices. Among them, Android is the most widely used (Agrawal & Trivedi, 2019). The popularity of the Android system has opened the door for attackers to increase the number of threats to Android devices (da Costa et al., 2020). According to the McAfee Labs Threats’ report in the first quarter of 2020, 98% of attackers target Android devices (Bayazit, Sahingoz, & Dogan, 2020).

Android is a Linux-based operating system that comes with a number of useful applications and middleware. Google allows third-party developers to build applications and release them to the Android Market in order to fully utilize and explore the capabilities of Android (Hein & Myo, 2018). The hacker takes advantage of Android application capabilities to compromise device security and privacy, posing a major risk of personal data leakage such as the user's location, contact information, accounts, images, and so on (R. Kumar et al., 2019).

Many levels of security tools exist to protect against cyberattacks, like firewalls, anti-virus, and Intrusion Detection system (IDS) (Uğurlu & Doğru, 2019). Firewalls primarily control access between networks and do not produce any signals if an attack occurs internally (Alqahtani et al., 2020). Antivirus is effective for detecting known malware and ineffective for detecting unknown malware. It needs to constantly update its databases to be effective and detect new samples of malware. IDSs come in two main categories: signature-based and anomaly-based detection. Signature detection identifies suspicious behaviour by matching it to an attack signature that has already been saved in a database. This type is less effective for detecting malicious activities, especially for new attacks, because they need to constantly update their signature databases. Anomaly detection considers normal behaviour to be a model and attempts to detect any deviation from the model before deciding whether or not to create an alarm. An anomaly-based IDS is better suited for detecting new malware attacks (Elkhadir, Chougdali, & Benattou, 2016). The major aim of an IDS is to detect various types of malwares like botnets, Trojans, spyware, backdoors, worms, ransomware, and riskware as quickly as possible, which is unachievable with a regular firewall (Zachariah, Akash, Yousef, & Chacko, 2017; Khraisat, Gondal, Vamplew, & Kamruzzaman, 2019).

Anomaly-based IDS employs three techniques to analyse and understand the behaviour of the malware, which are static, dynamic, and hybrid analysis. The static analysis technique decompiles an Android application package to obtain two main files (i.e., manifes.xml and classes. dex) and then starts to extract static features from these two files without executing them. Many features can be extracted from static analysis, such as permissions, intents, opcodes, used features, and API calls (Malik). The dynamic analysis technique is used to identify malicious behaviour when the application is running by extracting many features like system calls, network traffic, or hardware features utilization like CPU, memory, and battery. The hybrid technique combines the benefits of dynamic and static analysis (Bayazit et al., 2020; H. Zhou, Yang, Pan, & Guo, 2020).

Machine learning techniques are commonly used to detect Android malware, whether using static, dynamic, or hybrid analysis methods. Machine learning-based malware detection has the capability to detect previously unseen kinds of malware and can provide better detection and efficiency than traditional methods, such as signature-based malware detection, which is based on identifying the specific patterns of known malware (K. Liu et al., 2020).

This paper addresses the crucial issue of Android device security in the face of increasing threats and attacks. With smartphones playing an essential role in our daily lives and Android being the most widely used operating system, it has become a prime target for attackers. Anomaly-based IDSs offer a promising approach by considering normal behaviour as a model and detecting any deviations from it. This paper focuses on the analysis of malware behaviour using static, dynamic, and hybrid techniques and leverages machine learning to enhance malware detection. The findings of this study have the potential to enhance Android device security and mitigate the risks associated with personal data leakage and privacy breaches.

The remaining sections of our paper are organized as follows. Section 2 provides background information about Intrusion Detection Systems (IDS). Section 3 presents literature review in the field. Section 4 contains a discussion and comparison of our findings, followed by Section 5 which explores the challenges and recommendations associated with the topic. Finally, in Section VI, the points of conclusion arrived at throughout the study are presented.

2. Intrusion Detection System

Intrusion detection systems (IDS) monitor and analyse network logs, file system activity, and real-time events in the local system to detect cyber-attacks (P. Liu, 2019). Another definition of IDS is a new type of security technology that monitors a system for harmful activity (Borkar, Donode, & Kumari, 2017). An IDS can usually perform a variety of tasks, such as information monitoring and recording, security officer notification, and report generation. In general, smartphones consist of hardware, an operating system, and applications. An IDS system can monitor either an event at the application level, the kernel level, the hardware level, or a hybrid of them. The IDS system can work to detect malicious activities generated by malware apps like damaging file systems, information leakage, or any other types of threats. There are many classifications for IDS based on topology, source, approach, and focus. The details of the classification are illustrated in Figure 1 (Georgios Kambourakis, 2018).

Figure 1. IDS Classification

2.1. Detection approach

The detection method applied to identify intrusion detection systems (IDS) is classified to Signature-based and anomaly-based detection approaches. The misuse (signature) detection method maintains a database of predefined patterns and uses that database to track the usage of those patterns (BalaGanesh, Chakrabarti, & Midhunchakkaravarthy, 2018). Signatures are hashes created by many algorithms like MD5 and SHA256 for previously seen malicious applications. These hash values are saved in a database and can be used for scanning applications. During the scanning process, if the hash of the scanned application is found in the database, this application is marked as malicious (Borek, 2017). The advantage of misuse-based IDS is that it is capable of effectively recognizing known attacks, but it fails to detect unknown attacks. In order to store the signature of each known attack, a database must be persistently updated (Istiaque, Khan, & Waheed, 2020). In the anomaly method, a basic profile of a regular network or system activity is generated and then every incoming packet or event which differs from the profile is treated as an intrusion. The advantage of this method is that it is capable of detecting new attacks (Shamshirband et al., 2020). The problem with this strategy is that if a normal application makes more system calls, it may be classified as malware; and compared to signature-based IDS, anomaly-based IDSs are more computationally expensive (Chawla, Lee, Fallon, & Jacob, 2019).

2.2. Detection topology

Intrusion detection systems vary in design depending on the user's perspective. In general, they can be classified into host-based IDS and network-based IDS. In Host IDS (HIDS), the software installed on the host device helps to prevent malicious cyber-attacks by systems. One strategy is to detect normal system behaviour based on system call sequences performed by system processes (Chawla et al., 2019). An IDS based on the network (NIDS) monitors network traffic for suspicious, abnormal, or unauthorized activities that may result in a cyber-attack. Intrusion detection based on the network is based on the knowledge acquired. The methods for detecting such actions are based either on signatures (misuse detection) or behaviour-based (anomaly detection). Systems based on signatures detect attacks that are programmed to notify, while systems based on behaviour detect deviations from the usual behaviour profile and are able to detect unauthenticated attacks (S. Kumar, Viinikainen, & Hamalainen, 2016).

3. Literature Review

In 2011, smartphone manufacturers distributed around 450 million devices. In the same period, mobile malware spread quickly, leading to the development of many IDSs with the purpose of performing malware detection (Georgios Kambourakis, 2018). In this study, focus is on the intrusion detection framework related to the smartphone-based Android operating system at the application and system level and the analysis method used by researchers.

3.1. Malware IDS-based static features

Static analysis is used to detect malicious applications without requiring them to be run or executed on smartphones (Gyamfi & Owusu, 2018; Khariwal, Singh, & Arora, 2020). Static analysis is primarily concerned with analyzing the basic files of an Android application instead of executing them, which allows them to execute relatively quickly. The "AndroidManifest.xml" and "classes.dex" files are the two most common files in the static analysis process, from which representative features like permissions, intents, opcodes, API calls, and functional call graphs can be extracted, respectively (Jannat, Hasnayeen, Shuhan, & Ferdous, 2019; Lei, Qin, Wang, Li, & Ye, 2019). The process of static analysis is illustrated in Figure 2.

Figure 2. Process of static analysis

3.2. Manifest features

Analysing the Android manifest file is a common technique used in Android malware detection. The Android manifest file is an essential component of an Android application that contains important information about its functionalities and permissions. By examining this file, researchers can gain insights into the behaviour and potential risks associated with an app. The analysis of the Android manifest file involves extracting and inspecting various elements, such as permissions requested by the app, declared components (activities, services, and receivers), intent filters, and other metadata. This information helps in understanding the app's intended functionality and potential interactions with the device and other apps. Some malicious apps exploit these features to engage in unauthorized or harmful activities. The researchers built many machine learning and deep learning models for the purpose of detecting malicious activities resulting from mobile applications. In their studies, they employed single-feature category and multi-feature categories.

Khatter (2018) presented an intrusion detection system for classifying malicious applications based on permission analysis. Their system involves feature extraction, machine learning training, and model performance evaluation using a testing dataset. The study evaluates different machine learning algorithms, with kernel logistic regression achieving 98.2% accuracy for malware detection and LibLinear achieving 87.83% accuracy for classifying 81 malware families.

Sirisha and Anuradha (2019) introduced a sequential neural network model for predicting the presence of malware in Android APK files obtained from the web and Play Store. The model was trained on a dataset of 398 APK files with 331 features, and during testing, it was evaluated using data from the Play Store and malicious sites like Droidbench, which contained both malicious and benign APK files. The proposed method achieved an accuracy of over 85% in real-time detection of malicious applications based on permission extraction from the APK.

The researchers Kapoor, Kushwaha and Gandotra (2019), Alsoghyer and Almomani (2020), and Mathur, Podila, Kulkarni, Niyaz, and Javaid (2021) built and trained many machine-learning models based on permissions for detecting malware apps on Android devices, and all studies achieved accuracy above 96%. The researcher (Sandeep, 2019) presents a novel approach by developing a fully connected deep learning model for the detection of malicious applications, utilizing permission features. One distinguishing aspect of this study is the inclusion of additional details, such as application name and version, during the malware detection process.

Dharmalingam and Palanisamy (2021) proposed the Permission Grading System (PGS) to extract requested permissions from applications and detect the permissions that are special to malware and benign apps, with the contribution of each permission calculated. The presented model is effective only when malware and benign applications have different sets of permission.

Amer (2021) introduced a mechanism for analysing Android applications based on permission combinations indexed within the app. To improve the performance of the proposed model, multiple machine-learning algorithms were combined to create an ensemble model.

Analysing the intent filters declared by an app can help identify potential misuse. Malware authors may register intent filters to capture sensitive intents or intercept system-level events for malicious purposes. For instance, Sewak, Sahay and Rathore (2020) developed a method named Deep-Intent, which is an online Intrusion Detection System (IDS) that uses an E2E DL implementation for both supervised learning and unsupervised feature engineering, and only uses implicit intent as a feature. The experiment findings reveal that the presented intent-based IDS could detect malware application software with an AUC of 81% and an accuracy of 77.2%.

Khariwal et al. (2020), Jiang, Mao, Guan and Huang (2020), and Sangal and Verma (2020) have proposed robust models for detecting malicious applications by combining permissions and intents along with various machine learning algorithms. Khariwal et al. (2020) and Jiang et al. (2020) used an information gain algorithm to find the best subset of combined intents with permissions. Whereas Sangal and Verma (2020) utilized the PCA algorithm for feature reduction. In addition to permissions and intents, Y. Zhang, Feng, Huang, Ye and Weng (2020) added two other features, such as hardware and app component features, to their model for the prediction of the Android malware family based on the Driben dataset.

3.3. Classes or source code features

The classes.dex file contains the compiled bytecode of the app's classes and holds valuable information about the app's functionality. Usually, researchers extract two main feature categories from the class, which are API calls and opcodes. Analysing these features can help detect suspicious or malicious activities, such as accessing sensitive system resources, making unauthorized network requests. Zhao, Li, Zheng and Shi (2018) and Niu et al. (2020) extracted opcode sequences from the bytecode or classes of the Android app and utilized them as input for a deep learning model in order to detect Android malware. Both studies trained on small datasets and got high scores.

Ma, Ge, Liu, Zhao and Ma (2019) developed a novel approach based on the API call to identify malicious code in the Android system. They proposed a selection approach for API features relevant to malware, explored the structure interactions among these APIs, and developed a CNN classifier model for the classification of the API features. A real-world dataset with 3,697 malicious apps and 3,312 benign apps showed that the API features were efficient in classifying Android malware. H. Zhang, Luo, Zhang and Pan (2019) proposed a new malware detection method for Android applications based on correlation relationships among abstracted API calls. The source code is divided into function methods and association rules mining is used to define an application in computational semantics. Machine learning algorithms are used to distinguish benign and malicious.

There are many studies that combine the features from manifests and classes for the purpose of increasing the accuracy of the model. Lê, Nguyen, Truong, Nguyen and Ngô (2020) proposed a method of machine learning to identify Android malware apps. The features that are used to train machine learning are built based on behaviour, requisite permissions, and other features of malicious applications. The findings achieved an accuracy of 98.66% with a set of 28879 samples containing malicious and benign apps. Tiwari and Shukla (2018) proposed a system for detecting malware in mobile devices based on two common types of features: permission and API calls using machine learning algorithms. Due to the limited resources of the mobile device, the proposed system reduced the number of features in the dataset to 30 features using the PCA algorithm.

Singh, Wadhwa, Ahuja, Soni and Sharma (2020) proposed model uses Latent Semantic Indexing (LSI) to reduce the representation of opcodes in a lower-dimensional space, allowing the system to work with a smaller set of opcodes. Additionally, permissions and intents are added to the feature set to improve the performance of the model classifiers. The authors combine permissions with API call detecting ransomware application. Almomani et al (2021) developed an approach for detecting ransomware by combining permissions with API calls. The method employed the SVM approach for the classification while addressing the imbalance between benign and ransomware apps in the dataset through the use of the Synthetic Minority Oversampling Technique (SMOTE). This method offers a promising solution for accurately identifying ransomware based on its distinctive permissions and API patterns, providing enhanced security measures against this prevalent threat.

R. Kumar et al. (2019), Yerima and Alzaylaee (2020), and Esmaeili and Shahriari (2019) focused on combining manifest features with source code features to train deep learning models, including multimodal deep neural networks and CNNs. However, it is worth noting that these studies employed unbalanced datasets during the training process. Yerima and Alzaylaee (2020), Esmaeili and Shahriari (2019) focused on only one type of malware, which is botnets. Further, a framework based on the stacking approach is proposed by Xie, Qin and Di (2023). The proposed approach comprises three parts: dataset creation, feature reduction, and optimization method GA-StackingMD. The implementation of a stacking model comprising five base classifiers has resulted in a significant enhancement in detection accuracy when compared to the use of individual classifiers.

All the aforementioned studies on static analysis have a common limitation in that they solely relied on computer-based examination processes and did not involve the actual use of mobile devices. This limitation raises concerns about the real-world applicability and performance of the developed models for detecting malware on mobile devices. Feng, Liu and Lin (2019) introduced the MobiDroid system, which comprises two components for detecting malicious applications on mobile devices. The server component generates feature dictionaries and trains deep neural networks, while the mobile device component utilizes the dictionaries and trained model for on-device malware detection. The approach takes into account the performance limitations of Android devices, allowing users to balance classification accuracy and overall cost. Yuan, Jiang, Li and Cai (2019) developed an on-device lightweight Android malware detector based on the broad learning method. The presented system detector uses primarily one-shot model training calculation. It can therefore be trained directly or progressively on mobile devices. The model can be increased further via on-device model retraining.

The analysis of the Android manifest file and source code features has proven to be a common and effective technique in Android malware detection. These files contain crucial information about an application's functionalities and provide valuable insights into an app's behaviour and potential risks. Researchers have built numerous machine learning and deep learning models based on single-feature and multi-feature categories and got promising results. Despite these promising results, it is essential to address certain limitations. Most of the studies rely solely on computer-based testing, without considering the actual use of mobile devices. Ensuring real-world applicability and performance of the developed models on mobile devices remains a critical consideration for practical deployment.

Based on specific parameters, Table 1 represents the summary of the previous works that are based on static analysis.

Table 1. Summary of the papers based on static analysis

Reference	Dataset Sources	No. of Sample	Method	Analysis Tool	Feature Type	Acc. %	Pre. %	Recall %	F1 score%
(Khatter, 2018)	Drebin, Androtracker	B 533 M 527	NB,KLR,SLR,RBF, SMO, PART, CNN, SVM	AndroData Weak tool	Permission	98.2	---	---	---
(Zhao et al., 2018)	Drebin, Chinese app	B 1200 M 1200	CNN	APK Tool	Opcode	99.07	99.12	99.11	99.12
(Tiwari & Shukla, 2018)	GP, PRAGaurd	B 652 M 669	PCA and chi Square test for feature reduction and SVM for detection	AXMLPrinter2.jar	permission, API call	94.69	---	---	---
(R. Kumar et al., 2019)	GP,VirusShare, Malgenome	B 21047 M 14284	multimodal deep neural network	APK Tool	permission, API call, Opcode, others	98	---	98.2	---
(Sirisha & Anuradha, 2019)	---	398 for B and M	Sequential neural network	Androguard	Permission	85	---	---	---
(Kapoor et al., 2019)	GP , VirusShare and other trusted sites	B 1500 M 2500	LR, LDA, KNN, SVM, GNB, DT	python script	Permission	99.34	99.4	---	99.5
(Sandeep, 2019)	GP, Virsushre	---	RF for feature Selection DL for classification	Androguard	Permission	94.65	---	---	---
(Ma et al., 2019)	androzoo, AMD	B 10010 M 10683	DNN with LSTM	FLOWDROID	API call	---	99.15	98.82	98.98
(H. Zhang et al., 2019)	Drebin. AMD and androzoo	B 26464 M 26403	SVM, KNN,RF for classification and ARM for feature reduction	Andguard	API call	96	97	95	96
(Esmaeili & Shahriari, 2019)	Drebin	---	NB,DT,KNN	Androbug and MobSF tool	permission, API call, Intent, Network, Hardware, others	96	9.6	81.4	88.3
(Feng et al., 2019)	GP, Drebin, Genome,virusshare	B 21499 M 21499	CNN	ApkTool, AndroGuard, Soot, FlowDroid	permission, API call, Opcode	97	96.87	96.87	---
(Yuan et al., 2019)	AndroZoo,VirusShare and Contagio	B 33655 M 22221	BL	AXMLPrinter baksmali	permission, API call, Intent	94.71	92.4	89.61	93.42
(Khariwal et al., 2020)	Genome Drebin and Koodous	B 1414 M 1714	SVM, NB, RF for detection and IG for feature selection	Apktool	permission, Intent	94.37	---	---	---
(Alsoghyer & Almomani, 2020)	HelDroid, RansomProber ,Virus Total and Koodous	B 500 M 500	RF, J48, SMO, NB	Apk tool Weka tool	Permission	96.9	---	---	---
(Dharmalingam & Palanisamy, 2021)	GP, AAGM, AMD	B 1005 M 1592	Proposed PGS, SVM, DT, DNN, TF-IDF for feature Reduction	APKParser tool, XML-DOM	Permission	94.22	---	93.4	---
(Sewak et al., 2020)	GP and Drebin	B 5721 M 5560	SAE and MLP DNN	APKTOOL	Intent	77.2	---	---	---
(Jiang et al., 2020)	Xiaomi App Store, MalGenome and Andro- MalShare	B 1700 M 1600	SVM, KNN, NB, J48) for detection and IG for feature selection	Apktool Weka	permission, Intent	---	---	94.5	94.5
(Sangal & Verma, 2020)	CICInvesAndMal2019	B 1126 M 396	RF, KNN, NB, DT, SVM for classification and PCA For feature Selection	Weka	permission, Intent	96.05	96	96.1	96
(Y. Zhang et al., 2020)	Drebin	M 5554	LR , GBDT, RF	Dex.-jar	permission, Intent, Hardware, others	97.98	98.51	98.37	98.47
(Niu et al., 2020)	Virusshare , AndroZoo and Peapod.	B 1000 M 1796	LSTM	FlowDroid, drizzleDumper and FUPK3	Opcode	97	97	97	97
(Lê et al., 2020)	GP, Virusshare	B 12290 M 16589	NB,RF,DT, Gradient Boosting and AdaBoost	Dexdunp	permission, API call	98.66	---	---	---
(Singh et al., 2020)	CICInvesAndMal2019 Android Botnet	B 1147 M 905	LSI, SVM, LR, RF, KNN	Androguard	Permissions, Intents, opcodes	93.92	96.89	88.64	92.58
(Yerima & Alzaylaee, 2020)	ISCX botnet dataset	B 6803 M 1929	CNN	Developed by the author	permission, API call, Intent, others	98.9	98.3	97.8	98.1
(Mathur et al., 2021)	AndroZoo, Virus total, AMD	B 14730 M 14700	KNN,RF, LR, SVM,ET, XG,AB,BG	Androguard	Permission	96.95	---	---	---
(Amer, 2021)	Drebin MalGenome	B 9476 M 5560	Ensemble Model( RF, MLP, AdaBoost, SVM, DT)	---	Permission	99.3	98.8	99.3	99
(Almomani et al., 2021)	GP,VirusTotal, Koodous, RansomProper Project	B 9653 M 500	PSO, SVM and SMOTE	APK Tool	permission, API call	---	---	96.4	---
(Xie et al., 2023)	CICMalDroid2020	B 13204 M 4039	GA-StackingMD (SVM, KNN, LGBM, CatBoost, and RF)	Androguard	permission, API call, Opcode, Intent, others	98.66	99.15	99.06	99.1

Table 2. Summary of the papers that based on dynamic analysis

Reference	Dataset Sources	No. of Sample	Method	Analysis Tool	Feature Type	Acc. %	Pre. %	Recall %	F1 score%
(Ariyapala et al., 2016)	Created by Author	---	Markov Chain	WireShark	Network traffic, CPU, Battery, running process and services	---	---	---	---
(Xiao et al., 2019)	Drebin, Google Play	B 3567 M 3536	LSTM	Monkey and Strace	System call	93.7	91.3	96.6	---
(Radoglou-Grammatikis & Sarigiannidis, 2017)	CTU-13 dataset	---	MLP	---	Network traffic	85	---	---	---
(Q. Zhou et al., 2019)	Baidu Mobile Application market and VirusShare	B 920 M 379	Monte Carlo algorithm.	---	System call	97.85	---	98.7	---
(Wang et al., 2019)	Drebin	B 8321 M 5560	C4.5	TcpDump tool	Network traffic	97.89	---	---	---
(Abderrahmane et al., 2019)	ArgusLab, Darwin project	B 2450 M 10300	CNN	Android emulator, Monkey Tool, Strace Tool	System call	93.3	94.1	97.8	96
(Ribeiro et al., 2020)	Run Time Dataset Generation	B 1200 sample	One class K-mean and univariate Gaussian	---	Network traffic, CPU, Battery, Memory, running process and services	91	---	85.7	---
(John et al., 2020)	GP,Deribn, AMD and Malgenome	B 1410 M 720	Graph Convolutional Nets (GCN)	Emulator, Monkey Tool, Strace Tool, Weka	System call	92.3	91.5	93.3	92.3
(Mahdavifar et al., 2020)	CICMalDroid2020	B 1795 M 9803	DNN	CopperDroid	System call, Binder, Composite behaviour	96.7	99.16	96.54	97.84
(Barbhuiya et al., 2020)	Run Time Dataset Generation	---	One class classification and probability distribution	Emulator	Network traffic, CPU	93.3	---	---	---
(X. Zhang et al., 2022)	AMD, Google play	B 300 M 125	MLP	Monkey runner, trace tool, ADB tool	System call	99.34	99.12	99.07	99.44
(Manzil, 2022)	CICMalDroid2020	B 1795 M 1253	RF, DT, LR, SVM, and AdaBoost	Monkey runner, trace tool, ADB tool	System call	99.5	99.5	99.5	99.5
(Bansal et al., 2022)	CICMalDroid2020	B 1,795 M 9803	Light Gradient Boosting	Copper- Droid	System call, Binder, Composite behavior	98.01	99.19	98.39	98.79
(AlOmari et al., 2023)	CICMalDroid2020	B,M 11598	Light Gradient Boosting	CopperDroid	System call, Binder, Composite behavior	95.49	95.48	94.7	95.47

Table 3. Summary of the papers based on hybrid analysis

Reference	Dataset Sources	No. of Sample	Method	Analysis Tool	Feature Type	Acc. %	Pre. %	Recall %	F1 score%
(Y. Liu et al., 2016)	Wandoujia and Gnome project	B+M 500	SVM, KNN,NB	Apktool. ADB Tool, Strace Tool, Monkey Tool	permissions, API call, System calls	93.33~99.28	---	94.59~99.47	---
(Arshad et al., 2018)	Drebin, Genome	---	SVM RF,DT, NB	Asset Packaging tool ,Baksmali tool., Weka	Network	98.97	---	98.5	---
(Arora & Peddoju, 2018)	Genome Project	B 600 M 524	FP-Growth algorithm, IG and Chi-Square for feature selection	Apk tool	permissions, Network	94.25	---	97.9	---
(Vinayakumar et al., 2018)	MalGenome	B 408 M 1330	LSTM	Apk Tool, Adb monkey tool	permissions, Battery, Memory	93.9 ~ 97.5	---	---	---
(Kuo et al., 2019)	GP, Virusshare	B 1000 M 1000	SVM, RF	Apk tool, Emulator	permissions, API call	94	---	95	---
(Fang et al., 2019)	GP, Virusshare	B 4000 M 4000	XGBoost, Bayesian classifier for detection and classification. TF-IDF for feature filtering	Apk Tool, BackSmali Tool, MALINE Tool Monkey Tool ,Emulator, Strace Tool	permissions, API call	94.6	---	---	---
(Garg & Baliyan, 2019)	GP, Wandouji, AMD, Androzoo	B 60000 M 25450	ensemble (SVM, PART, MLP, RIDOR)	Apk tool, Emulator, ADB shell, Strace tool	permissions, API call, System calls, Network, Battery, CPU, Memory	98.27	---	98.79	---
(Shyong et al., 2020)	GP, Drebin	B 1000 M 1024	RF	aapt dump permissions, Emulator,Tcpdump ,Monkey tool	permissions, Network	96 ~98.86	---	---	---
(N. Zhang et al., 2021)	PlayDrone, Drebin	B 2978 M 2707	CNN, BiLTSM	Strace, Monkey, AndroGuard, ADB tools	Opcode, System calls	97	56.5	95.5	96