# On building machine learning pipelines for Android malware detection: a procedural survey of practices, challenges and opportunities

arXiv: https://arxiv.org/abs/2306.07118 · HTML: https://mlsanity.com/paper/2306.07118/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 15 of its 112 references that are in the map.
- First posted on arXiv 12 Jun 2023.

## Builds on (most cited first, 15 of 15)

- [Distributed Representations of Words and Phrases and their Compositionality](https://mlsanity.com/paper/1310.4546/) (2013)
- [On Evaluating Adversarial Robustness](https://mlsanity.com/paper/1902.06705/) (2019)
- [Explainable Machine Learning in Deployment](https://mlsanity.com/paper/1909.06342/) (2019)
- [Yes, Machine Learning Can Be More Secure! A Case Study on Android Malware Detection](https://mlsanity.com/paper/1704.08996/) (2017)
- [Robust Android Malware Detection System against Adversarial Attacks using Q-Learning](https://mlsanity.com/paper/2101.12031/) (2021)
- [MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models (Extended Version)](https://mlsanity.com/paper/1711.07477/) (2017)
- [DL-Droid: Deep learning based android malware detection using real devices](https://mlsanity.com/paper/1911.10113/) (2019)
- [Similarity-based Android Malware Detection Using Hamming Distance of Static Binary Features](https://mlsanity.com/paper/1908.05759/) (2019)
- [A Preliminary Study On the Sustainability of Android Malware Detection](https://mlsanity.com/paper/1807.08221/) (2018)
- [A New Android Malware Detection Approach Using Bayesian Classification](https://mlsanity.com/paper/1608.00848/) (2016)
- [High Accuracy Android Malware Detection Using Ensemble Learning](https://mlsanity.com/paper/1608.00835/) (2016)
- [A Review on The Use of Deep Learning in Android Malware Detection](https://mlsanity.com/paper/1812.10360/) (2018)
- [Do Gradient-based Explanations Tell Anything About Adversarial Robustness to Android Malware?](https://mlsanity.com/paper/2005.01452/) (2020)
- [Android Malware Detection Using Parallel Machine Learning Classifiers](https://mlsanity.com/paper/1607.08186/) (2016)
- [A Survey on Cross-Architectural IoT Malware Threat Hunting](https://mlsanity.com/paper/2306.07989/) (2023)

## Built on by (most cited first, 1 of 1)

- [MH-1M: A 1.34 Million-Sample Comprehensive Multi-Feature Android Malware Dataset for Machine Learning, Deep Learning, Large Language Models, and Threat Intelligence Research](https://mlsanity.com/paper/2511.00342/) (2025)

## Abstract (arXiv)

As the smartphone market leader, Android has been a prominent target for malware attacks. The number of malicious applications (apps) identified for it has increased continually over the past decade, creating an immense challenge for all parties involved. For market holders and researchers, in particular, the large number of samples has made manual malware detection unfeasible, leading to an influx of research that investigate Machine Learning (ML) approaches to automate this process. However, while some of the proposed approaches achieve high performance, rapidly evolving Android malware has made them unable to maintain their accuracy over time. This has created a need in the community to conduct further research, and build more flexible ML pipelines. Doing so, however, is currently hindered by a lack of systematic overview of the existing literature, to learn from and improve upon the existing solutions. Existing survey papers often focus only on parts of the ML process (e.g., data collection or model deployment), while omitting other important stages, such as model evaluation and explanation. In this paper, we address this problem with a review of 42 highly-cited papers, spanning a decade of research (from 2011 to 2021). We introduce a novel procedural taxonomy of the published literature, covering how they have used ML algorithms, what features they have engineered, which dimensionality reduction techniques they have employed, what datasets they have employed for training, and what their evaluation and explanation strategies are. Drawing from this taxonomy, we also identify gaps in knowledge and provide ideas for improvement and future work.