## 2 Related Work
While focusing solely on the developer's commit message data in cases of vulnerability remediation can yield quick and effective results, these messages are often brief and may lack detail, necessitating an examination of the source code for accurate vulnerability identification. Therefore, evaluations and analyses conducted directly on the source code will likely yield more precise results. Similarly, VCCFinder [25] combines code metrics with GitHub metadata and utilizes a support vector machine (SVM) to flag potentially vulnerable commits. By identifying commits that fix security vulnerabilities, it aims to predict potential vulnerabilities heuristically. However, the primary limitations of this approach include a highly restricted dataset and a focus on only one specific programming language. As an interesting study around Android applications [26], it developed a machine learning system that analyzes Android app code to generate functional descriptions with 69-84% accuracy. This approach aids security inspections by providing contextual insights into app behavior. In reference [27], the conducted work describes a dataset of real-world software vulnerabilities from the Android Open Source Project (AOSP). The dataset links these vulnerabilities to the specific code changes (commits) that fix them, providing valuable information for security researchers. However, the dataset has limitations. It only includes vulnerabilities from open-source projects and relies on Google's Security Bulletins for information. Despite these limitations, the dataset can be used to understand vulnerabilities, analyze how they are fixed, and develop better vulnerability detection tools. Similarly, the study [8] focuses on vulnerability-fixing commits to detect vulnerabilities employing various models. Furthermore, research in the reference [28] introduces a labeled dataset of Android source code vulnerabilities called LVDAndro to help Android app developers identify source code vulnerabilities in real time. The dataset is limited by the number of vulnerability scanners, which generally produce lots of false positives used to create and have a smaller number of code examples featuring CWE-IDs that are less common in real-world applications. Detecting vulnerabilities in Android applications remains challenging due to the inadequacy of existing datasets, which do not sufficiently support the training of machine learning (ML) models. This issue is further compounded by the lack of sufficient real-world data required for building such models. To address this problem, this study presents a dataset created from real-world data, including snippets of source codes following the developers' activities when fixing the vulnerabilities in its code base. Although vulnerability detection and malware detection are often mistakenly treated as interchangeable, they are fundamentally different, with distinct objectives and underlying dynamics. Vulnerability detection specifically focuses on identifying weaknesses in systems that could be exploited, whereas malware detection aims to uncover harmful software or behavior. Understanding these distinctions is critical for understanding this study's contribution, which aims to advance the field of vulnerability detection by addressing key gaps in real-world dataset availability and reproducibility. Some key studies [29; 30; 31; 32] examined in this review [33] have explored various challenges in Android malware detection, many of which hold valuable insights for improving vulnerability detection methods. A recurring issue is the heavy reliance on outdated or small datasets, such as MalGenome [34] and Drebin [35], which fail to capture modern threat dynamics. This limitation hinders the training of robust machine learning models and often results in overfitting. Combining static and dynamic analysis has been proposed as a solution, as static features are vulnerable to obfuscation, while dynamic features, though more robust, are harder to collect.