## 1 Introduction  
One of the goals of Android is to create an open and secure platform for mobile devices and various other device form factors while allowing users to install applications from different sources [1]. As mentioned here, Android is open source and users can install apps from different stores other than the official app store. Furthermore, according to the statistics released by Statista, Android has the highest usage in the world with a market share of 70.1% while the Apple iOS operating system reported a market share of 29.2% in the fourth quarter of 2023 [2]. Due to the fact that Android is the most popular mobile operating system worldwide and for the reasons mentioned above, malicious applications are created with the intention of accessing user data or causing harm to people who use Android applications. Consequently, Google is also implementing security steps to prevent such malicious applications and lessen their effect on users. According to the information on the Google developer website, Google Play Protect is a tool that was created in 2017 and is used to scan 125 billion applications every day. This tool enables Google to react swiftly to threats and limit the number of devices and users that are impacted by them [3]. This program did not have a real-time scanning feature before last year; thus, customers could not always analyse the application they planned to install. Google Security blog revealed that real-time app detection would be included in Google Play Protect in October 2023 [4]. In addition, as malware developers develop new methods and improvements to overcome these obstacles, these tools may also be insufficient. As a result, more potent and dynamic techniques for Android malware detection must be developed. Android malware applications pose many risks for users. These risks generally include the seizure of users' personal data; financial losses; and the theft of usernames, passwords, and similar information. Furthermore, Android malware poses various security problems for self-driving vehicles [5]. The Financial Threats Report for 2023 by Kaspersky reveals significant increases in mobile banking malware and cryptocurrency-related phishing [6]. In light of these data, it is extremely important to develop strong and effective systems for detecting Android malware in order to protect users from these risks. Different methods have been developed in the literature on Android malware detection and are available to users. There are three Android malware detection methods in the literature: static, dynamic, and hybrid [7; 8; 9; 10; 11]. In static analysis, features are extracted by unpacking or disassembling applications [12; 13; 14]. Static analysis is a behaviour-based approach to Android malware detection that extracts static features of Android applications without running them on an emulator or on a real device [15; 16; 17]. In this method, the features of Android applications are obtained by reverse engineering the.apk file [18; 19; 20; 21]. Detection methods based on static analysis are further divided into several categories, including visualisation/bytecode sequence properties, permissions, opcode sequences, API calls, inter-component communication (ICC), class.dex files, and mixed static properties [9]. Dynamic analysis mainly studies the runtime behaviour of applications [11; 13; 16; 22]. Dynamic analysis monitors the behaviour of applications (i.e., memory usage, network access, dynamic taint, etc.) and the effects of the application on this isolated environment [23; 24; 25; 26]. Researchers often choose system calls, API calls, and network traffic as dynamic features [10]. Hybrid analysis utilises a combination of dynamic and static methods [7; 10; 13]. Static analysis methods often use permissions and API call features, while dynamic/hybrid analysis methods often use permissions, API calls, intents, and system calls, and rarely use CPU/memory/battery consumption data, META-INF, certificates, and HTTP streams [9].