## 1 Introduction
### Related Work
\begin{table}
\begin{tabular}{p{71.1 pt} p{284.5 pt} p{284.5 pt}} \hline \hline
**Topics** & **Paper Ref.** & **Description** \\ \hline Log Collection & [21] & Android security, log retrieval and analysis. Collection of system-generated logs at runtime and filtering for analysis. Log management tool to collect and display installation log files and track changes during the installation process. \\ \hline Malware Analysis & [23] & Malware analysis and a framework combining machine learning and static analysis. Hybrid Android malware detection combining dynamic and static analysis. Framework for Android system call processing to detect malware early. BMD: bi-level malware detection using application programming interface (API) call sequences and co-evolutionary algorithm. \\ \hline Permissions & [27] & Permission monitoring in Android security to categorise applications and use static analysis to detect malware. \\  & [28] & Permission classification as an information gain metric for improved detection accuracy. \\ \hline Package Analysis & [29] & Review of the techniques combining static and dynamic analysis with studying Android applications. Static data flow analysis tool and library developed for the purpose of computing data flows in Android applications and Java programs. \\  & [31] & Python-based tool designed for reverse-engineering of Android applications by breaking down raw Android Package Kit (apk) files. A static analysis framework for the security evaluation of Android apps. \\ \hline HIDS & [33] & An HIDS system that runs on mobile devices and detects known and zero-day attacks using machine learning and statistical algorithms. \\  & [34] & A Review of system-call-based HIDS, including feature extraction, data mining algorithms, HIDS datasets, and applicability to embedded systems. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Table summarising the related work. A framework for system call processing has been proposed to address this issue, focusing on analysing system calls made by Android applications [25]. The bi-level malware detection method (BMD) was also introduced to improve detection accuracy by utilising API call sequences and a co-evolutionary algorithm [26]. The experiments performed on Android datasets showed that BMD outperforms existing state-of-the-art methods for malware detection. Other articles focus on the role of permissions in Android security and permission monitoring to investigate access to the sensitive data and resources of the device [27]. In terms of permission monitoring, the researchers presented a method for classifying Android applications based on their access to private information and the abuse of this information. The method categorises applications into three types based on their access to private information. Then, a static analysis is used to detect Android malware utilising the information and permissions of the applications. In another study [28], the authors used the classification of permissions as an information gain metric to provide better detection accuracy. In [29], the researchers proposed a technique that combines static and dynamic analysis to examine Android applications. This approach makes it possible to expand an application's method call graph (MCG) by capturing additional modules loaded at runtime and additional paths of execution concealed by reflection calls. The researchers also reported the analysis of recent state-of-the-art tools that should be taken into account, namely Flowdroid [30], AndroGuard [31], and Amandroid [32], among others. Other researchers [33] proposed using host-based intrusion detection systems (HIDSs) to run entirely on a mobile device without relying on a remote server. The application monitors the device by regularly sampling features that represent the overall use of the device's resources, such as the central processing unit (CPU), random access memory (RAM), battery, and others. The detection engine adopts machine learning and statistical algorithms to detect known and unprecedented (zero-day) attacks.