Comparable or Not? A Protocol-Aware Survey of Machine Learning for Android Malware Detection, 2009–2025
Description
Android malware detection studies report performance on heterogeneous corpora, labels, metrics and evaluation protocols, which limits direct comparison between them. This structured critical survey covers 116 studies published 2009–2025 (117 grid entries), separates core detectors from supporting methodology and historical context, and records for each its analysis type, features, learner, corpus, size, contribution, representative metric and principal limitation, grouped by learning technique. Of the 97 core detector entries, 62 record an accuracy as their representative figure; the rest report another metric or none. Restricted to the 37 single-valued accuracies we extracted from primary full texts, the median is 98.2% and the interquartile range 2.05 points, and neither publication year nor corpus size accounts for more than a tenth of their variation. Because these values come from different corpora and protocols, they do not support a controlled comparison of methods. Worked case studies on one real-device corpus illustrate how the evaluation protocol, the passage of time and the withholding of whole families change what a single detector appears to achieve. We close with open problems and reporting recommendations that separate what the evidence shows from what it cannot show.