# N-opcode Analysis for Android Malware Classification and Categorization

arXiv: https://arxiv.org/abs/1607.08149 · HTML: https://mlsanity.com/paper/1607.08149/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 27 Jul 2016.

## Built on by (most cited first, 6 of 6)

- [MG-DVD: A Real-time Framework for Malware Variant Detection Based on Dynamic Heterogeneous Graph Learning](https://mlsanity.com/paper/2106.12288/) (2021)
- [ActDroid: An active learning framework for Android malware detection](https://mlsanity.com/paper/2401.16982/) (2024)
- [Reassessing feature-based Android malware detection in a contemporary context](https://mlsanity.com/paper/2301.12778/) (2023)
- [Light up that Droid! On the Effectiveness of Static Analysis Features against App Obfuscation for Android Malware Detection](https://mlsanity.com/paper/2310.15645/) (2023)
- [Adversarial Patterns: Building Robust Android Malware Classifiers](https://mlsanity.com/paper/2203.02121/) (2022)
- [Self-Supervised Learning for Android Malware Detection on a Time-Stamped Dataset](https://mlsanity.com/paper/2604.23025/) (2026)

## Abstract (arXiv)

Malware detection is a growing problem particularly on the Android mobile platform due to its increasing popularity and accessibility to numerous third party app markets. This has also been made worse by the increasingly sophisticated detection avoidance techniques employed by emerging malware families. This calls for more effective techniques for detection and classification of Android malware. Hence, in this paper we present an n-opcode analysis based approach that utilizes machine learning to classify and categorize Android malware. This approach enables automated feature discovery that eliminates the need for applying expert or domain knowledge to define the needed features. Our experiments on 2520 samples that were performed using up to 10-gram opcode features showed that an f-measure of 98% is achievable using this approach.