# Reassessing feature-based Android malware detection in a contemporary context

arXiv: https://arxiv.org/abs/2301.12778 · HTML: https://mlsanity.com/paper/2301.12778/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 58 references that are in the map.
- First posted on arXiv 30 Jan 2023.

## Builds on (most cited first, 6 of 6)

- [Dos and Don'ts of Machine Learning in Computer Security](https://mlsanity.com/paper/2010.09470/) (2020)
- [How to avoid machine learning pitfalls: a guide for academic researchers](https://mlsanity.com/paper/2108.02497/) (2021)
- [DexRay: A Simple, yet Effective Deep Learning Approach to Android Malware Detection based on Image Representation of Bytecode](https://mlsanity.com/paper/2109.03326/) (2021)
- [Identification of Significant Permissions for Efficient Android Malware Detection](https://mlsanity.com/paper/2103.00643/) (2021)
- [N-opcode Analysis for Android Malware Classification and Categorization](https://mlsanity.com/paper/1607.08149/) (2016)
- [A Review on The Use of Deep Learning in Android Malware Detection](https://mlsanity.com/paper/1812.10360/) (2018)

## Built on by (most cited first, 1 of 1)

- [MH-1M: A 1.34 Million-Sample Comprehensive Multi-Feature Android Malware Dataset for Machine Learning, Deep Learning, Large Language Models, and Threat Intelligence Research](https://mlsanity.com/paper/2511.00342/) (2025)

## Abstract (arXiv)

We report the findings of a reimplementation of 18 foundational studies in feature-based machine learning for Android malware detection, published during the period 2013-2023. These studies are reevaluated on a level playing field using a contemporary Android environment and a balanced dataset of 124,000 applications. Our findings show that feature-based approaches can still achieve detection accuracies beyond 98%, despite a considerable increase in the size of the underlying Android feature sets. We observe that features derived through dynamic analysis yield only a small benefit over those derived from static analysis, and that simpler models often out-perform more complex models. We also find that API calls and opcodes are the most productive static features within our evaluation context, network traffic is the most predictive dynamic feature, and that ensemble models provide an efficient means of combining models trained on static and dynamic features. Together, these findings suggest that simple, fast machine learning approaches can still be an effective basis for malware detection, despite the increasing focus on slower, more expensive machine learning models in the literature.