{"id":"https://openalex.org/W7127952484","doi":"https://doi.org/10.7717/peerj-cs.3312","title":"A comprehensive review of Android malware: trends, behaviors, taxonomies, and future direction","display_name":"A comprehensive review of Android malware: trends, behaviors, taxonomies, and future direction","publication_year":2026,"publication_date":"2026-02-06","ids":{"openalex":"https://openalex.org/W7127952484","doi":"https://doi.org/10.7717/peerj-cs.3312"},"language":"en","primary_location":{"id":"doi:10.7717/peerj-cs.3312","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.3312","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.7717/peerj-cs.3312","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030555338","display_name":"Collins Chimeleze","orcid":"https://orcid.org/0000-0003-0595-2214"},"institutions":[{"id":"https://openalex.org/I79156528","display_name":"Universiti Tenaga Nasional","ror":"https://ror.org/03kxdn807","country_code":"MY","type":"education","lineage":["https://openalex.org/I79156528","https://openalex.org/I874769580"]}],"countries":["MY"],"is_corresponding":true,"raw_author_name":"Collins Uchenna Chimeleze","raw_affiliation_strings":["Institute of Informatics and Computing in Energy, Universiti Tenaga Nasional, Kajang, Selangor, Malaysia"],"affiliations":[{"raw_affiliation_string":"Institute of Informatics and Computing in Energy, Universiti Tenaga Nasional, Kajang, Selangor, Malaysia","institution_ids":["https://openalex.org/I79156528"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048153887","display_name":"Mohammed A. Al\u2010Sharafi","orcid":"https://orcid.org/0000-0003-0726-6031"},"institutions":[{"id":"https://openalex.org/I134085113","display_name":"King Fahd University of Petroleum and Minerals","ror":"https://ror.org/03yez3163","country_code":"SA","type":"education","lineage":["https://openalex.org/I134085113"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Mohammed A. Al-Sharafi","raw_affiliation_strings":["King Fahad University of Petroleum and Minerals, Interdisciplinary Research Center for Finance and Digital Economy, KFUPM Business School, Dhahran, Saudi Arabia"],"affiliations":[{"raw_affiliation_string":"King Fahad University of Petroleum and Minerals, Interdisciplinary Research Center for Finance and Digital Economy, KFUPM Business School, Dhahran, Saudi Arabia","institution_ids":["https://openalex.org/I134085113"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121008196","display_name":"Norziana Jamil","orcid":null},"institutions":[{"id":"https://openalex.org/I117222138","display_name":"Abu Dhabi University","ror":"https://ror.org/01r3kjq03","country_code":"AE","type":"education","lineage":["https://openalex.org/I117222138"]},{"id":"https://openalex.org/I161913731","display_name":"Al Ain University","ror":"https://ror.org/023abrt21","country_code":"AE","type":"education","lineage":["https://openalex.org/I161913731"]},{"id":"https://openalex.org/I201726411","display_name":"United Arab Emirates University","ror":"https://ror.org/01km6p862","country_code":"AE","type":"education","lineage":["https://openalex.org/I201726411"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Norziana Jamil","raw_affiliation_strings":["Department of Information Systems and Security, College of IT, United Arab Emirates University, Al Ain, Abu Dhabi, United Arab Emirates"],"affiliations":[{"raw_affiliation_string":"Department of Information Systems and Security, College of IT, United Arab Emirates University, Al Ain, Abu Dhabi, United Arab Emirates","institution_ids":["https://openalex.org/I201726411","https://openalex.org/I117222138","https://openalex.org/I161913731"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5030555338"],"corresponding_institution_ids":["https://openalex.org/I79156528"],"apc_list":{"value":1395,"currency":"USD","value_usd":1395},"apc_paid":{"value":1395,"currency":"USD","value_usd":1395},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.30189197,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"12","issue":null,"first_page":"e3312","last_page":"e3312"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9925000071525574,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9925000071525574,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.0019000000320374966,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.000699999975040555,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/android","display_name":"Android (operating system)","score":0.8374999761581421},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7056999802589417},{"id":"https://openalex.org/keywords/popularity","display_name":"Popularity","score":0.5888000130653381},{"id":"https://openalex.org/keywords/android-malware","display_name":"Android malware","score":0.5223000049591064},{"id":"https://openalex.org/keywords/multidisciplinary-approach","display_name":"Multidisciplinary approach","score":0.38179999589920044},{"id":"https://openalex.org/keywords/android-application","display_name":"Android application","score":0.33709999918937683}],"concepts":[{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.8374999761581421},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7056999802589417},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.5888000130653381},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5248000025749207},{"id":"https://openalex.org/C2989133298","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android malware","level":3,"score":0.5223000049591064},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.49970000982284546},{"id":"https://openalex.org/C22467394","wikidata":"https://www.wikidata.org/wiki/Q849359","display_name":"Multidisciplinary approach","level":2,"score":0.38179999589920044},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.3409999907016754},{"id":"https://openalex.org/C3017891749","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android application","level":3,"score":0.33709999918937683},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3319000005722046},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.3269999921321869},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.3149000108242035},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2976999878883362},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.27619999647140503},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.2614000141620636},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2515999972820282}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.7717/peerj-cs.3312","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.3312","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:dc4e36979d61463d99998f47eb88b82b","is_oa":true,"landing_page_url":"https://doaj.org/article/dc4e36979d61463d99998f47eb88b82b","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"PeerJ Computer Science, Vol 12, p e3312 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.7717/peerj-cs.3312","is_oa":true,"landing_page_url":"https://doi.org/10.7717/peerj-cs.3312","pdf_url":null,"source":{"id":"https://openalex.org/S4210178049","display_name":"PeerJ Computer Science","issn_l":"2376-5992","issn":["2376-5992"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310320104","host_organization_name":"PeerJ, Inc.","host_organization_lineage":["https://openalex.org/P4310320104"],"host_organization_lineage_names":["PeerJ, Inc."],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"PeerJ Computer Science","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6812726259231567,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G7620327723","display_name":null,"funder_award_id":"12R316","funder_id":"https://openalex.org/F4320323593","funder_display_name":"United Arab Emirates University"}],"funders":[{"id":"https://openalex.org/F4320323593","display_name":"United Arab Emirates University","ror":"https://ror.org/01km6p862"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":133,"referenced_works":["https://openalex.org/W1924618820","https://openalex.org/W1979290264","https://openalex.org/W1987510309","https://openalex.org/W1992207658","https://openalex.org/W2002941278","https://openalex.org/W2004152166","https://openalex.org/W2033616728","https://openalex.org/W2065304158","https://openalex.org/W2087493624","https://openalex.org/W2092898274","https://openalex.org/W2122646361","https://openalex.org/W2136391011","https://openalex.org/W2140904795","https://openalex.org/W2157286909","https://openalex.org/W2173536757","https://openalex.org/W2180696299","https://openalex.org/W2283589440","https://openalex.org/W2289508129","https://openalex.org/W2339647006","https://openalex.org/W2365033090","https://openalex.org/W2397292410","https://openalex.org/W2407026356","https://openalex.org/W2418633638","https://openalex.org/W2511008193","https://openalex.org/W2548161504","https://openalex.org/W2557105261","https://openalex.org/W2571339157","https://openalex.org/W2575599800","https://openalex.org/W2587101704","https://openalex.org/W2604376377","https://openalex.org/W2766428736","https://openalex.org/W2767152659","https://openalex.org/W2773487925","https://openalex.org/W2780954022","https://openalex.org/W2789654058","https://openalex.org/W2800472070","https://openalex.org/W2805704668","https://openalex.org/W2807825543","https://openalex.org/W2889379935","https://openalex.org/W2897514040","https://openalex.org/W2902957699","https://openalex.org/W2905007452","https://openalex.org/W2908789442","https://openalex.org/W2911311548","https://openalex.org/W2920790154","https://openalex.org/W2921434519","https://openalex.org/W2922526186","https://openalex.org/W2943698254","https://openalex.org/W2945015800","https://openalex.org/W2947158132","https://openalex.org/W2963379686","https://openalex.org/W2964460094","https://openalex.org/W2970916071","https://openalex.org/W2980284849","https://openalex.org/W2988961468","https://openalex.org/W3004042723","https://openalex.org/W3007999664","https://openalex.org/W3018465441","https://openalex.org/W3022550689","https://openalex.org/W3023859395","https://openalex.org/W3033416561","https://openalex.org/W3034085154","https://openalex.org/W3035030939","https://openalex.org/W3040566537","https://openalex.org/W3048741687","https://openalex.org/W3080825594","https://openalex.org/W3083703328","https://openalex.org/W3090850795","https://openalex.org/W3095017951","https://openalex.org/W3096660718","https://openalex.org/W3111444395","https://openalex.org/W3128172745","https://openalex.org/W3128404610","https://openalex.org/W3129375586","https://openalex.org/W3129460895","https://openalex.org/W3130682519","https://openalex.org/W3132588576","https://openalex.org/W3163940456","https://openalex.org/W3165851208","https://openalex.org/W3168482278","https://openalex.org/W3168512044","https://openalex.org/W3186172578","https://openalex.org/W3194679964","https://openalex.org/W3196494933","https://openalex.org/W3197481603","https://openalex.org/W3200508744","https://openalex.org/W3210188939","https://openalex.org/W3210724588","https://openalex.org/W3215946960","https://openalex.org/W3216621585","https://openalex.org/W4210342233","https://openalex.org/W4210914440","https://openalex.org/W4214732596","https://openalex.org/W4221077261","https://openalex.org/W4248958414","https://openalex.org/W4250610954","https://openalex.org/W4251657239","https://openalex.org/W4280565328","https://openalex.org/W4281657944","https://openalex.org/W4281920725","https://openalex.org/W4283155559","https://openalex.org/W4284883451","https://openalex.org/W4285043541","https://openalex.org/W4290694460","https://openalex.org/W4293535508","https://openalex.org/W4294068565","https://openalex.org/W4296982334","https://openalex.org/W4301431031","https://openalex.org/W4307570965","https://openalex.org/W4309724303","https://openalex.org/W4311029901","https://openalex.org/W4311779867","https://openalex.org/W4312713307","https://openalex.org/W4313119132","https://openalex.org/W4324093415","https://openalex.org/W4327771520","https://openalex.org/W4377088603","https://openalex.org/W4381548520","https://openalex.org/W4384301457","https://openalex.org/W4387941248","https://openalex.org/W4389185880","https://openalex.org/W4389632922","https://openalex.org/W4391251754","https://openalex.org/W4391623592","https://openalex.org/W4393435331","https://openalex.org/W4398199997","https://openalex.org/W4400120404","https://openalex.org/W4403564140","https://openalex.org/W4403600385","https://openalex.org/W4403918422","https://openalex.org/W4404127725","https://openalex.org/W4406085105","https://openalex.org/W4409709589"],"related_works":[],"abstract_inverted_index":{"The":[0,119],"increasing":[1],"prevalence":[2],"of":[3,76],"malicious":[4],"applications":[5],"targeting":[6],"the":[7,38,61,137],"Android":[8,46,62,80,98,117,143],"operating":[9],"system":[10],"has":[11],"intensified":[12],"security":[13],"challenges":[14],"in":[15,135],"recent":[16],"years.":[17],"As":[18],"Android\u2019s":[19],"popularity":[20],"continues":[21],"to":[22,57,115],"grow,":[23],"it":[24,95],"not":[25],"only":[26],"attracts":[27],"users":[28,131],"but":[29],"also":[30],"becomes":[31],"a":[32,54,73],"prime":[33],"target":[34],"for":[35,41,53,125],"cybercriminals,":[36],"underscoring":[37],"critical":[39],"need":[40],"robust":[42],"defenses":[43],"against":[44],"advanced":[45,116],"malware.":[47,118],"This":[48,70],"survey":[49,71],"manuscript":[50],"is":[51],"intended":[52],"multidisciplinary":[55],"field":[56],"evaluate":[58],"and":[59,67,85,92,101,132],"analyse":[60],"malware":[63,81,99,144],"trend,":[64],"behaviors,":[65],"taxonomies,":[66],"future":[68,126],"direction.":[69],"presents":[72],"comprehensive":[74],"review":[75],"study":[77,120],"trends,":[78],"examines":[79],"behaviors":[82],"over":[83],"time,":[84],"analyzes":[86],"their":[87],"patterns":[88],"across":[89],"platforms,":[90],"families,":[91],"regions.":[93],"Additionally,":[94],"evaluates":[96],"existing":[97],"taxonomies":[100],"identifies":[102],"key":[103],"gaps.":[104],"To":[105],"address":[106],"these":[107],"gaps,":[108],"we":[109],"propose":[110],"an":[111],"enhanced":[112],"taxonomy":[113],"tailored":[114],"concludes":[121],"with":[122],"actionable":[123],"recommendations":[124],"research,":[127],"aimed":[128],"at":[129],"assisting":[130],"industry":[133],"professionals":[134],"mitigating":[136],"evolving":[138],"risks":[139],"posed":[140],"by":[141],"sophisticated":[142],"attacks.":[145]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2026-02-07T00:00:00"}