## 2 Related Work
Another concern is the inconsistency of in-app behavior across devices, which complicates detection accuracy, particularly in large-scale systems like federated learning. These challenges highlight the importance of using up-to-date datasets, incorporating adaptive modeling, and addressing the complexities of evolving threats. Lessons from these studies could also guide future efforts to make vulnerability detection more effective and resilient in real-world applications. Authors in study [36] propose a supervised learning approach for Android malware detection using a labeled dataset of over 18,000 samples across five categories, validated with multiple benchmark datasets. The method demonstrates competitive performance compared to state-of-the-art techniques, offering insights into malware classification and detection improvements. The current study aims to locate real-world Android application codes by investigating vulnerability-fix commits and obtaining vulnerable source code slices for future machine-learning research. The following research questions identify the reasoning and key points behind this initiative. Research Questions (RQs)  
1. Why are we doing this? Since it is shown that using synthetic datasets is not as effective as it should [13], working with real-world code is crucial. To the best of our knowledge, although a couple of malware datasets are available, there is a lack of properly labeled vulnerable code datasets in Android applications in the literature to assist with automated ways of conducting vulnerability research [37]. Therefore, it will be addressing this gap once it has been done. 2. Why is it important? As our lives become increasingly digitalized, spotting vulnerabilities before malicious actors exploit them is becoming more critical. Therefore, efficiently detecting vulnerable code has gained significant importance in today's world, and novel ML/DL methods are emerging to identify and mitigate security risks. Unlike many previous approaches [15; 16; 20; 21; 22; 28], our method leverages real-world vulnerability fixing commits, allowing the detection models to learn from actual security patches. This real-world data enhances the model's ability to identify complex, real-world vulnerabilities that are often encountered in practice, improving its effectiveness in real-world software environments. 3. Which benefits can we have after this research? This study contributes to vulnerability detection research by constructing a dataset derived from real-world code changes, addressing a critical gap in the availability of publicly accessible vulnerable code samples. The dataset facilitates the development and evaluation of machine learning models in real-world scenarios, improving the generalizability and reliability of automated vulnerability detection approaches. Furthermore, by leveraging real-world vulnerability fixes, this research enhances the reproducibility of security studies and supports the advancement of tools and techniques for secure Android development. 4. Why is this a unique study? Some previous studies [28] have relied on specific tools for dataset creation, and the false-positive results produced by these tools have been identified as a significant factor affecting system performance by leading to incorrect learning. Additionally, earlier works [24; 25] primarily focused on commit messages without incorporating the associated source code, making this study unique in its approach. Furthermore, some studies ([15; 21]) still use old datasets with static code metrics only.