A Critical Review of Android Malware Detection Techniques (2014–2026): Evaluating Static, Dynamic, Hybrid, and Deep Learning Approaches

Abstract

Over the past decade, Android malware detection has advanced a great deal, yet a persistent gap remains between the accuracy figures reported on benchmarks and what these systems actually achieve once deployed. This paper reviews thirty-one Android malware detection systems and reputation-intelligence platforms published between 2014 and 2026, spanning static, dynamic, hybrid, and deep-learning approaches, and compares them against six practical criteria: detection accuracy, obfuscation resilience, computational overhead, scalability, temporal robustness, and practical deployability. Benchmark accuracy rose from around 94% for Drebin to 98.1% for SeGDroid over this period, but Pendlebury et al.’s TESSERACT framework shows that a large share of these reported numbers is inflated by temporal and spatial evaluation bias. The paper also looks at reputation-based platforms such as VirusTotal, MetaDefender, Hybrid Analysis, and ANY.RUN, Intezer Analyze, MalwareBazaar, and AndroZoo, comparing what each contributes to Android malware research and dataset construction. Drawing on this review, a generalized multi-stage detection pipeline is proposed, and the paper closes by outlining the research gaps that should guide future work on both the research and deployment sides of Android malware detection.