Enhancing the Robustness of Android Malware Detection Systems Against Adversarial Attacks: A Systematic Review of Defense Strategies and Emerging Challenges
This paper presents a systematic literature review (2020–2025) of AI-based Android malware detection systems, analyzing their vulnerabilities to adversarial attacks, evaluating existing defense strategies, and identifying critical gaps and future research directions for achieving robust and trustworthy security.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the digital world of smartphones, the Android operating system has become the most common platform for communication, work, and entertainment, holding a dominant share of the global market. This widespread use makes it a prime target for malicious software, or malware, designed to steal identities, spy on users, or launch cyberattacks. For years, security experts relied on simple checklists to catch these threats, looking for known bad code or specific permissions. However, as malware creators developed more sophisticated tricks to hide their work, these old methods began to fail. In response, scientists turned to artificial intelligence, teaching computers to recognize the subtle patterns of bad behavior rather than just looking for exact matches. Yet, this shift created a new vulnerability: the very intelligence used to catch the bad actors can be tricked. Just as a human can be fooled by a clever disguise, these AI systems can be manipulated by carefully crafted changes that make a malicious app look harmless to the detector while keeping its harmful nature intact.
A team of researchers from Abubakar Tafawa Balewa University in Nigeria recently set out to understand this evolving battlefield. They conducted a comprehensive review of scientific studies published between 2020 and 2025 to map out how well current AI systems defend against these tricks and where they might still be failing. By systematically analyzing nearly two hundred peer-reviewed papers, they traced the journey of Android malware detection from simple rule-based checks to complex, self-learning computer models. Their work reveals that while modern artificial intelligence is incredibly good at spotting new types of malware, it is also surprisingly fragile when faced with an attacker who knows how to exploit its weaknesses. The researchers found that the field is moving away from relying on a single, perfect solution and is instead building layered defenses that combine different strategies to create systems that are not only accurate but also trustworthy and private.
The story of how these systems work begins with the data they are fed. To teach a computer to spot a virus, researchers need vast libraries of examples, both good and bad. The review highlighted that the most common tools for this job are large, public collections of software samples, such as the Drebin and CICMalDroid datasets. These collections vary widely in quality and age, which affects how well the resulting security tools perform. In the past, experts manually picked specific features to look for, such as which permissions an app requested or what files it tried to access. Today, the trend has shifted toward letting the computer learn these features on its own. Advanced models, including deep learning systems that mimic the human brain and graph-based networks that map relationships between different parts of an app, can now automatically discover complex patterns that human designers might miss. These modern approaches are generally more accurate than their older counterparts, but they come with a higher cost in terms of computing power and time.
However, this increased sophistication has opened the door to a new kind of threat known as adversarial attacks. The researchers identified that these attacks come in several forms, each designed to break the system in a different way. The most common type is the evasion attack, where a malicious app is slightly altered—perhaps by adding useless code or changing a few permissions—to confuse the detector into thinking it is safe, all while keeping its ability to steal data or damage the phone. There are also poisoning attacks, where bad actors sneak harmful examples into the training data itself, teaching the AI to ignore certain types of malware from the start. Other threats involve stealing the secrets of the AI model or figuring out exactly what data was used to train it, which compromises user privacy. The review made it clear that these attacks are not just theoretical; they are a real and growing danger that can bypass even the most advanced detection systems if the models are not specifically hardened against them.
To fight back, scientists have developed a variety of defense strategies, but the review found that no single method is a silver bullet. One of the most effective techniques is adversarial training, where the AI is deliberately exposed to these tricky, disguised examples during its learning phase so it can learn to recognize them. While this makes the system much tougher, it requires significant computing resources and can still be fooled by new, unseen tricks. Other promising approaches include using explainable artificial intelligence, which helps human analysts understand why a decision was made, and federated learning, which allows different organizations to train a shared model without ever sharing their private data. The researchers concluded that the most robust path forward is not to rely on one shield, but to build a multi-layered defense. This involves combining adversarial training with privacy protections, transparency tools, and hybrid models that use multiple ways of analyzing an app at once.
The ultimate goal, according to the study, is to move beyond simply asking if a system is accurate and start asking if it is trustworthy. A detection system that is highly accurate but easily tricked or that leaks private information is not a true solution. The authors suggest that future research must focus on creating standardized ways to test how well these systems hold up under attack, developing datasets that reflect the real world rather than just laboratory conditions, and designing AI that can adapt to new threats as they appear. As the battle between malware creators and security defenders continues, the consensus is clear: the future of mobile security lies in intelligent systems that are not only smart enough to find the bad actors but also resilient enough to withstand the tricks they will inevitably try next.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.