## 5 Results and Discussion  
The constructed dataset provides a comprehensive resource for analyzing Android application source code vulnerabilities. The systematic approach to identifying vulnerability-fixing commits across 366,231 repositories out of 2.9 million repositories successfully yielded a collection of real-world vulnerable code snippets. These snippets, derived from actual developer fixes, offer unique insights into patterns of security flaws and remediation strategies. The dataset comprises 20,004 unique vulnerability-fixing commits, comprising 426,246 code snippets, each labeled with metadata such as the associated CVE identifier (when available) and repository information. It also adds the commits that fix the vulnerability, considering each commit contains a vulnerability and its patches. Preliminary experiments using this dataset to train machine learning models for vulnerability detection show promising results. Early iterations of these models achieved a detection accuracy of 98.71% for known vulnerability patterns, indicating the dataset's potential to enhance automated security assessments. Our findings underline the value of using real-world data to fill gaps in detecting vulnerabilities in Android apps. This dataset, unlike artificial ones, reflects real practices and provides a great foundation for training machine learning models. However, there are some limitations. Relying on commit messages and specific keywords might overlook some vulnerabilities, especially in repositories with unconventional or minimal documentation. Public repositories also dominate the dataset, potentially leaving out vulnerabilities in private projects, which may be more sensitive or critical. Additionally, deeper semantic analysis, such as inter-procedural dependencies or taint analysis, could enhance the model's ability to detect complex vulnerabilities. This work shows that real-world, practice-based research datasets can be extremely valuable. It also demonstrates the importance of refining and expanding these datasets to improve the machine-learning models used for Android security. Future studies can use the dataset to explore alternative feature representations, deep learning models, or hybrid \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Research Paper** & **Technique** & **Classifier** & **Dataset/Tools** & **Feature** & **Evaluation** \\ \hline [PERSON] et al. [15] & ML & RandomForest & Fdroid [46] & static code metrics & 91.38\% \\ \hline [PERSON] et al. [21] & DL & DNN & Fdroid [46] & Static analysis/source code & 92.87\% \\ \hline [PERSON] et al. [22] & ML & J48 JRip & \begin{tabular}{} \end{tabular} & Static metrics & 96\% \\ \hline [PERSON] et al. [28] & ML & XGBoost & \begin{tabular}{} \end{tabular} & code chunks & 94\% \\ \hline Defendroid [14] & ML & \begin{tabular}{} \end{tabular} & Lvdandro dataset [28] & code chunks & 96\% \\ \hline This study & ML & \begin{tabular}{} \end{tabular} & \
\begin{tabular}{} \end{tabular} &
\begin{tabular}{} \end{tabular} & code snippets & 98.71\% \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of machine learning-based vulnerability detection approaches in Android applications. approaches combining static and dynamic analysis. The dataset can also be extended with additional real-world security patches to improve generalizability. We encourage researchers to apply and refine our methodology, contributing to the advancement of automated vulnerability detection in software security. Conceptualization, K.E.A. and E.N.Y. ; methodology, K.E.A. ; software, K.E.A. ; validation, formal analysis, investigation, resources, data curation, writing--original draft preparation, writing--review and editing, visualization, project administration, K.E.A. and E.N.Y. ; supervision, E.N.Y. All authors have read and agreed to the published version of the manuscript. The APC was funded by Aselsan. Not applicable.