Deep learning-based android malware detection under realistic evaluation constraints: an architecture-centric review and reliability-aware empirical validation.
5 affiliations
- 1Faculty of Computing, Universiti Malaysia Pahang Al-Sultan Abdullah, Pekan, Pahang, Malaysia.
- 2PER5ONA Lab, Faculty of Engineering, Universiti Teknologi PETRONAS, Bandar Seri Iskandar, Malaysia.
- 3Huanjiang Laboratory, Shaoxing, Zhejiang, China.
- 4Faculty of Computing, Management, and Sciences, Universiti Teknologi PETRONAS, Bandar Seri Iskandar, Malaysia.
- 5Department of Electrical Engineering, California State University San Marcos, San Marcos, CA, United States.
Abstract
Deep learning (DL) has reshaped Android malware detection (AMD) by enabling models to learn from heterogeneous Android artifacts, including permissions, DEX and bytecode representations, API and system-call traces, network traffic, image encodings, and program graphs. However, high benchmark accuracy does not necessarily imply reliable, robust, explainable, reproducible, or deployable malware detection. This study examines DL-based AMD under realistic evaluation constraints through an architecture-centric systematic review and reliability-aware empirical validation. A PRISMA-guided review of studies published between 2021 and 2026 was conducted to analyze architecture families, artifact representations, dataset transparency, validation realism, robustness and evasion evidence, explainability, reproducibility, and deployment readiness. Controlled empirical validation was also conducted on CICMalDroid 2020 using representative CNN, GRU, Transformer, and Hybrid CNN-LSTM models. The review shows that DL-based AMD is architecturally diverse, but its supporting evidence remains incomplete. Most studies report datasets, feature sources, model architectures, and conventional metrics, whereas robustness testing, artifact-grounded explainability, reproducibility assets, and deployment evidence remain inconsistent. The empirical validation shows that although all models achieve strong clean cross-validation performance, class-wise analysis, malware false-negative behavior, repeated-run stability, and multi-level test-time feature masking reveal architecture-dependent reliability differences that are not captured by aggregate accuracy. The study contributes an architecture-artifact-validation triad and a claim-aligned reliability audit to align AMD claims with the maturity of supporting evidence. Overall, the findings support a transition from accuracy-centric benchmarking to reliability-centric evaluation, where models are assessed using credible datasets, realistic validation, robustness, interpretability, reproducibility, and operational feasibility.
Related
- A unified multi-domain framework for hallucination detection and reliability evaluation in large language models
- Explainable Multimodal AI for In-Hospital Detection of Lung Cancer and Heart Failure Using Routine Data: Development, Internal Validation, and Simulated Federated Evaluation
- Spatial Colorimetric Mapping of pH and Dissolved Carbon during Convective Dissolution of CO{\_2}: Constraints from Domain, Geometry, and Indicator Mix on Measurement Reliability
- YOLO-Spectra-Net: Reliability-Aware RGB–Infrared Fusion for Robust Object Detection Under Adverse Conditions
- LongHaul-Bench: A Reproducible Benchmark for Long-Horizon Reliability of Self-Improving LLM Agents Under Industrial Edge Constraints
BibTeX
@article{hussain2026deep,
title = {{Deep learning-based android malware detection under realistic evaluation constraints: an architecture-centric review and reliability-aware empirical validation.}},
author = {Syed Shuja Hussain and Mohd Faizal Ab Razak and Idris Ismail and Ahmad Firdaus and Abdul Azeem and Jamil Zara and Shamim Akhter},
journal = {Frontiers in artificial intelligence},
year = {2026},
month = oct,
doi = {10.3389/frai.2026.1964400},
url = {https://europepmc.org/article/MED/42953032},
note = {CC BY},
}
RIS
TY - JOUR
TI - Deep learning-based android malware detection under realistic evaluation constraints: an architecture-centric review and reliability-aware empirical validation.
AU - Syed Shuja Hussain
AU - Mohd Faizal Ab Razak
AU - Idris Ismail
AU - Ahmad Firdaus
AU - Abdul Azeem
AU - Jamil Zara
AU - Shamim Akhter
PY - 2026
DA - 2026/10/14
JO - Frontiers in artificial intelligence
DO - 10.3389/frai.2026.1964400
UR - https://europepmc.org/article/MED/42953032
AB - Deep learning (DL) has reshaped Android malware detection (AMD) by enabling models to learn from heterogeneous Android artifacts, including permissions, DEX and bytecode representations, API and system-call traces, network traffic, image encodings, and program graphs. However, high benchmark accuracy does not necessarily imply reliable, robust, explainable, reproducible, or deployable malware detection. This study examines DL-based AMD under realistic evaluation constraints through an architecture-centric systematic review and reliability-aware empirical validation. A PRISMA-guided review of studies published between 2021 and 2026 was conducted to analyze architecture families, artifact representations, dataset transparency, validation realism, robustness and evasion evidence, explainability, reproducibility, and deployment readiness. Controlled empirical validation was also conducted on CICMalDroid 2020 using representative CNN, GRU, Transformer, and Hybrid CNN-LSTM models. The review shows that DL-based AMD is architecturally diverse, but its supporting evidence remains incomplete. Most studies report datasets, feature sources, model architectures, and conventional metrics, whereas robustness testing, artifact-grounded explainability, reproducibility assets, and deployment evidence remain inconsistent. The empirical validation shows that although all models achieve strong clean cross-validation performance, class-wise analysis, malware false-negative behavior, repeated-run stability, and multi-level test-time feature masking reveal architecture-dependent reliability differences that are not captured by aggregate accuracy. The study contributes an architecture-artifact-validation triad and a claim-aligned reliability audit to align AMD claims with the maturity of supporting evidence. Overall, the findings support a transition from accuracy-centric benchmarking to reliability-centric evaluation, where models are assessed using credible datasets, realistic validation, robustness, interpretability, reproducibility, and operational feasibility.
SN - 2624-8212
ER -