## 5 Threats to Validity  
Threats to validity encountered throughout the experiment are described in this section. According to [PERSON] et al. [76], Android malware detection is becoming more relevant, and  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & **Accuracy** & **AUC** &
\begin{tabular}{c} **F-** \\ **Measure** \\ \end{tabular} & **Precision** & **Recall** & **TPR** & **FPR** \\ \hline \({}^{*}\) FPA & 98.13 & 0.997 & 0.981 & 0.981 & 0.981 & 0.981 & 0.025 \\ \({}^{*}\) Cas\_FPA & 98.83 & 0.999 & 0.988 & 0.988 & 0.988 & 0.016 \\ \({}^{*}\) RoF\_FPA & 98.38 & 0.997 & 0.984 & 0.984 & 0.984 & 0.023 \\ \({}^{*}\) Cas\_FPA+SMOTE & **98.94** & **0.999** & **0.989** & **0.990** & **0.989** & **0.989** & **0.011** \\ \({}^{*}\) RoF\_FPA+SMOTE & 98.49 & 0.998 & 0.985 & 0.985 & 0.985 & 0.985 & 0.015 \\ [PERSON] et al. [73] & - & - & 0.869 & - & - & 0.939 & - \\ [PERSON], [PERSON] and [PERSON] [64] & 97.92 & - & - & - & - & - & - \\ [PERSON] et al. [74] & - & - & 0.970 & - & - & - & - \\ [PERSON] et al. [75] & 94.00 & - & - & - & - & - & - \\ [PERSON] and [PERSON] [66] & 97.24 & - & 0.972 & 0.976 & - & 0.969 & 0.239 \\ [PERSON], [PERSON], [PERSON] and [PERSON] [34] & 97.92 & - & - & - & 0.976 & - & - \\ \hline \hline \end{tabular}
\end{table}
Table 15: Detection performances of proposed methods and existing models on the Drebin dataset.  
a critical component of every empirical research is analysing and mitigating risks to the validity of experimental findings.  
External validity: External validity is primarily concerned with the capacity to generalize the experimental investigation. The type and number of datasets used in the experimentation process may have an impact on the generalizability of the research findings. As such, two prominent and widely used Android malware datasets with varied numbers of malware families (Malgenome, 49; Drebin, 179) were investigated. These datasets are publicly available and are regarded as de facto Android malware datasets for training and testing Android detection models. In addition, we presented a detailed analysis of the experimentation process, which can aid in replication and validation of our experimental processes on various Android malware datasets.  
Internal validity: Internal validity emphasizes the importance and consistency of datasets, ML methods, and empirical analysis. To address this issue, prominent ML methods developed and implemented in existing studies were utilized in this research work. The ML methods were chosen based on their performance and heterogeneity. Additionally, to eliminate unintended mistakes in experimental results, the investigated Android malware models were carefully deployed on the selected malware datasets using the cross-validation method, repeating each experiment 10 times for completeness. Nonetheless, future research should consider alternative model evaluation approaches and strategies.  
Construct validity: Construct validity is concerned with the selection of performance measurements used to assess the efficacy of experimental Android malware detection models. In this research work, accuracy, AUC, F-measure, precision, recall, FPR, and TPR were utilized. These metrics provided an elaborate and comprehensive detection analysis of the experimented Android malware detection models. Additionally, the investigated models for Android malware detection were designed to exclusively identify whether an app is benign or malicious.