## 2 Related Studies
[PERSON] and [PERSON] extracted permissions, activities, intents, services, providers, and receiver properties from the AndroidManifest.xml file using the.apk file Androguard [52] tool, as well as API calls, unique opcode sequences, and protected string properties [53]. Each character of all extracted application properties was converted into pixel values using ASCII code and filtering was performed with the help of a predefined dictionary [53]. In creating the RGB image file, the information was obtained as a result of the conversion of API calls and unique opcode sequences from the DEX file in the red channel; all suspected permissions and application components were extracted for values in the green channel, and the conversions of protected strings, suspected permissions, app components, and API calls in the blue channel were used [53]. The generated RGB image file was classified with a CNN and an Accuracy of 99.37% was obtained [53]. In [PERSON] et al. 's study, API calls in the class.dex files were obtained using the Androguard [52] tool [54]. These API calls were summed by adding the ASCII value of each character, and the resulting value was modulo 256 to obtain the pixel value in the range of 0-255 [54]. At the end of the conversion, the pixel values of the standard API calls were set to the red channel, the suspicious and risky API calls were set to the blue channel, and each pixel value was set to 0 for the green channel to obtain an RGB image [54]. All suspicious and risky Android API calls were identified using a dictionary created based on various studies and datasets [54]. After the images were obtained, the random resizing layer resized the input image to a random size and the random padding layer filled the surroundings of the resized image with random zeros to increase the success of the developed model [54]. After this step, the classification process was performed using the autoencoder algorithm and an Accuracy of 96% was obtained [54]. [PERSON] et al. obtained the API call sequences in the smali file using the Apktool [55] tool [56]. Each *.smali file contained \".class\", \".super\", \".implements\", and \".invoke\" related identifiers and object class, super class, interface, and API calls [56]. In this way, all internal function elements of the applications were obtained [56]. A feature database for the system APIs was created and used as a basis for the next feature sequence analysis and visualisation, which contains a total of 50,998 methods in 5858 Android API classes from level 1 to 30, with a fixed colour value setting for each system method [56]. The Depth-first search algorithm was used to generate a system-level API call sequence for all internal function call methods in the application one by one [56]. Their system obtained an accuracy of 98.9% and a robustness coefficient of 91.7% with the CNN and CGAN algorithms [56]. [PERSON] and [PERSON] obtained RGB image files using Opcodes for the R channel, sensitive API packages for the G channel, and risky API functions for the B channel [57]. The Android operating system has a total of 255 Opcodes, which are encoded between 0x00 and 0 xFF according to different functions [57]. By converting the hexadecimal value of the Opcode (in Android OS) to a decimal value, the R channel was digitised by matching pixels [57]. In order to extract API call features, it was divided into 58 classes according to their packages, with 18 classes (user privacy or device hardware such as camera and microphone) belonging to the high-risk level [57]. When this is reduced to the method level, they found that there are 41 high-risk methods [57]. After the image file was obtained, classification was performed with the CNN model and an Accuracy of 0.9067, Precision of 0.9336, and F1-score of 0.9356 were obtained [57]. Studies on detecting Android malware applications have been examined in the literature, and it has been observed that the CNN method is the most used method for classification among the studies examined.