DroidDetect: A Polysemous Detection Paradigm

• DroidDetect is a polysemous label used across systems that perform Android malware analysis, object detection, and AI-generated code detection.
• Droidetec, a prominent variant, utilizes sequence modeling with Skip-Gram embeddings and Bi-LSTM attention to classify apps with high accuracy and localize malicious code segments.
• Other implementations include dynamic boot-phase analysis and vision-based detection pipelines, each employing tailored methodologies like global alignment or OpenCV techniques.

Searching arXiv for papers relevant to "DroidDetect" and closely related Android malware/code-detection systems. I’ll check for the arXiv entries tied to "DroidDetect", "Droidetec", and related Android malware detection systems. “DroidDetect” is not a single standardized system in the research literature. The name has been used for multiple detection-oriented frameworks, including Android malware analysis, an Android object-detection application, and AI-generated code detection, while the closely related “Droidetec” denotes a specific Android malware detector and malicious-code localizer based on deep learning (Ma et al., 2020). Across these usages, the shared design pattern is the conversion of raw artifacts—API invocations, system-call traces, images, or source code—into structured representations that support classification, localization, or statistical hypothesis testing. The term therefore functions as a polysemous research label rather than a canonical architecture.

1. Terminological scope and major usages

The literature associates “DroidDetect” and the near-variant “Droidetec” with several distinct technical systems rather than a single lineage (Ma et al., 2020, Elrefaei et al., 2017, Vidal et al., 2024, Orel et al., 11 Jul 2025).

Name in literature	Detection target	Core representation
Droidetec	Android malware detection and malicious code localization	API-call behavior sequence with Skip-Gram embeddings and Bi-LSTM attention
“DroidDetect” prototype	Android malware during app boot	Boot-phase system-call sequences, global alignment, bagging, Wilcoxon test
“DroidDetect” Android application	Object detection on Android	HSV masks, Circular Hough Transform, Douglas-Peucker, BRISK
DroidDetect suite	AI-generated code detection	Encoder-only ModernBERT classifier over code tokens

This multiplicity creates an immediate terminological risk. In Android security, the most technically developed deep-learning system in the supplied literature is “Droidetec,” not “DroidDetect.” By contrast, the 2025 code-detection work explicitly names its detector suite “DroidDetect.” A common misconception is therefore to treat all occurrences as referring to one Android-malware framework. The record instead shows separate systems with different observables, threat models, and evaluation protocols.

2. Droidetec: sequence modeling of Android application behavior

Droidetec models an Android APK as a sequence of API invocations extracted from Dalvik bytecode rather than as a flat permission vector or a purely graph-theoretic summary (Ma et al., 2020). The method begins from the DEX-defined method set $M=\{m_1,\dots,m_N\}$ and constructs cross-reference sets $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$ and $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$. A root-method set is then defined as

$$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$

Starting from each $m\in RM$, Droidetec performs a depth-first API extraction over invoke-* opcodes. Every encountered API call $a_k$ is recorded, yielding a single behavior sequence

$A=(a_1,a_2,\dots,a_T).$

API calls are vectorized through a learned dense embedding. If the API vocabulary size is $L$, each call can first be viewed as an $L$-dimensional one-hot vector, and Skip-Gram learns an embedding matrix $W\in\mathbb{R}^{L\times v}$ such that

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$0

The paper chooses $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$1. For the $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$2 application’s $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$3 API call,

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$4

The resulting per-application sequence of embeddings is $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$5. Because $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$6 varies across applications, Droidetec fixes a maximum sequence length $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$7 equal to the maximum $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$8 in the training set, then right-pads shorter sequences with the zero vector and truncates longer ones.

The classifier is a Bi-Directional LSTM with attention. Its topology comprises an input layer over $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$9, forward and backward LSTM passes, an attention layer, and a two-class softmax output for $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$0. The forward and backward states are

$$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$1

and the combined state is

$$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$2

Attention is defined by

$$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$3

with application representation

$$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$4

The final prediction is

$$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$5

Training uses cross-entropy loss with an $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$6 penalty over the embedding matrix, LSTM kernels, attention parameters, and output weights. The reported experimental setup uses an 80% training and 20% testing split, batch size 64 subsequences per gradient update, Adam with initial learning rate $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$7, hidden size $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$8 per direction, embedding size $$R_{\mathrm{to}}(m_i)=\{m_j\in M\mid m_j \text{ directly invokes } m_i\}$$9, and 10–20 epochs until validation accuracy converges. This places Droidetec squarely within sequence-based static malware analysis, but with explicit representation learning rather than manual feature engineering.

3. Malicious code localization, empirical performance, and limits of Droidetec

A central feature of Droidetec is that the attention weights are reused as a localization signal for malicious code segments (Ma et al., 2020). After obtaining $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$0 for each timestep, the highest-scoring API calls are treated as the most influential for the malware decision. Let the top-$$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$1 suspect APIs be the $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$2 indices with largest attention values, with the paper giving an example of $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$3. A method $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$4 is then scored by how many of these high-attention APIs it contains:

$$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$5

$$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$6

Sorting methods by $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$7 yields the most likely loci of malicious code, and the default report returns the top $$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$8 methods. Localization is evaluated by a hit rate, defined as the fraction of malware apps in which at least one true malicious method appears in the top-$$RM=\{m\in M\mid \mathrm{ind}(m)=|R_{\mathrm{to}}(m)|=0 \text{ and } \mathrm{outd}(m)=|R_{\mathrm{from}}(m)|>0\}.$$9 list, and by method-level localization accuracy, defined as the average fraction of the reported methods that are truly malicious.

The evaluation uses 21,598 apps, comprising 9,616 malicious samples from AMD and 11,982 benign samples from Google Play. The vocabulary contains approximately 65,732 distinct APIs, filtered to 65,689 after removing 43 very common ones. The reported best overall detection results are Accuracy $m\in RM$0, $m\in RM$1, and false-positive rate $m\in RM$2. With top 9 methods reported, malicious code localization attains hit rate $m\in RM$3 and overall method accuracy $m\in RM$4. By API-vector size, the 200-dimensional embedding gives the best tradeoff, at approximately $m\in RM$5 with about $m\in RM$6 $m\in RM$7. Family-specific detection is reported as stable above $m\in RM$8 for most families, with the lowest performance, approximately $m\in RM$9, on small-sample families such as Dowgin and AndroRAT.

The comparison section places Droidetec above several baselines. Relative to Droid-Sec using a DBN, it reports $a_k$0 accuracy and $a_k$1 false-positive rate; relative to Zhao et al.’s ensemble on sensitive APIs, $a_k$2 accuracy; and relative to SVMs on plain API usage or permissions, $a_k$3–$a_k$4 accuracy. The paper characterizes the method as “static-only” yet capable of capturing rich sequential behavior, and as resilient against code obfuscation because it operates purely on invoke-* bytecodes. A plausible implication is that its robustness claim is tied less to deobfuscation per se than to its invariance to some source-level transformations.

The limitations are explicit. Native code in dynamically loaded .so libraries is not analyzed. Full feature extraction costs approximately $a_k$5, representing about $a_k$6 of total runtime. In the worst case of very deep or highly recursive call graphs, the DFS extraction cost grows exponentially in invocation depth $a_k$7, with $a_k$8. Potential vulnerability to bytecode-level adversarial sample generation is noted but not studied. The stated future directions are multi-class malware-family prediction, speedup through better caching or incremental analysis of shared libraries, finer-grained segment-level localization, integration with dynamic or hybrid analysis, and adversarial robustness.

4. Boot-sequence DroidDetect for Android malware screening

A separate Android-malware system described as a “DroidDetect” prototype focuses on dynamic behavior during application initialization rather than static bytecode structure (Vidal et al., 2024). Its architecture has three layers: monitoring, analysis, and decision-making. In the monitoring layer, each newly downloaded APK is launched inside a lightweight sandbox on the handset. The Android Zygote process is hooked with strace to record all system calls made during app startup, and only the boot-phase calls from Zygote fork to the end of initialization are captured. Consecutive repetitions of the same syscall are collapsed into a single symbol, yielding a trace over an alphabet of size $a_k$9, the number of kernel-supported syscall types. The preprocessed trace, of length at most $A=(a_1,a_2,\dots,a_T).$0 and exemplified as 2,000 symbols, is then sent to a central server.

The analysis layer maintains a reference database $A=(a_1,a_2,\dots,a_T).$1 of legitimate-app boot sequences. From $A=(a_1,a_2,\dots,a_T).$2, the method draws $A=(a_1,a_2,\dots,a_T).$3 bootstrapped subsets $A=(a_1,a_2,\dots,a_T).$4 of fixed size $A=(a_1,a_2,\dots,a_T).$5. An incoming test sequence $A=(a_1,a_2,\dots,a_T).$6 is aligned against every sequence in each $A=(a_1,a_2,\dots,a_T).$7 using pairwise global alignment by Needleman–Wunsch. The scoring recurrence is

$A=(a_1,a_2,\dots,a_T).$8

$A=(a_1,a_2,\dots,a_T).$9

where $L$0 if $L$1 and $L$2 otherwise, with distinct gap penalties $L$3 and $L$4. The resulting score vectors are sorted and aggregated component-wise:

$L$5

Decision-making is performed with a paired Wilcoxon signed-rank test between the aggregated test-score vector $L$6 and a reference vector $L$7 built from clean boots. With paired differences $L$8, the test computes $L$9 and $L$0 over signed ranks and uses $L$1. For large $L$2, it converts to

$L$3

then rejects $L$4 if the two-sided $L$5-value is below $L$6. If rejected, the application is labeled malicious; otherwise benign.

The reported experiments use multiple real Android phones, legitimate apps drawn from 19 popular titles, 9 malware families from Genome and Drebin, and 300 boot traces per app, totaling approximately 5,700 traces. The parameter grid varies sequence length $L$7 from 50 to 2,000, confidence levels from $L$8 down to $L$9 and later to $W\in\mathbb{R}^{L\times v}$0, and example bagging parameters $W\in\mathbb{R}^{L\times v}$1, $W\in\mathbb{R}^{L\times v}$2. The optimum configuration is reported at $W\in\mathbb{R}^{L\times v}$3, $W\in\mathbb{R}^{L\times v}$4 or $W\in\mathbb{R}^{L\times v}$5 for stricter operation, with overall true positive rate approximately $W\in\mathbb{R}^{L\times v}$6 and overall false positive approximately $W\in\mathbb{R}^{L\times v}$7. For $W\in\mathbb{R}^{L\times v}$8, average true positive rate is below $W\in\mathbb{R}^{L\times v}$9; it saturates at or above $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$00 for $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$01.

This framework differs sharply from Droidetec. It is dynamic rather than static, alignment-based rather than neural, and explicitly statistical in its final decision rule. Its documented weaknesses are parameter sensitivity, the $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$02 cost of global alignment, sandbox-induced noise, and evasion vectors such as delayed malicious behavior past the capture window or anti-debugging responses to strace.

5. DroidDetect as an Android computer-vision application

In another usage, an implementation-oriented summary presents a “DroidDetect” Android application for object detection based on color, shape, or local features, built with Eclipse IDE and the OpenCV3 Library (Elrefaei et al., 2017). The system operates on images loaded from the gallery or camera and exposes three pipelines.

For color detection, the image is converted from RGB to HSV, with OpenCV’s 8-bit channel ranges $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$03, $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$04, and $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$05. Binary masks are created by thresholding within per-color ranges such as green with $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$06, $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$07, and $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$08, followed by Gaussian blur, one erosion and one dilation, and contour extraction. For shape detection, circular objects are found using the Circular Hough Transform with Canny thresholds low $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$09, high $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$10, radius range $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$11 to $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$12, vote threshold $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$13, and radius step $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$14. Non-circular contours are approximated by the Douglas–Peucker algorithm, with the summary stating that $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$15 gives good shape fidelity; polygons with $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$16 are labeled triangles, while $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$17 are separated into squares versus rectangles by right-angle checks and the criterion $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$18.

For local-feature matching, the application uses BRISK with a FAST-type detector across an image pyramid of 3 octaves and 4 layers per octave, AGAST score ranking, non-maximum suppression radius $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$19, up to 1,000 keypoints per image, Hamming-distance matching, Lowe’s ratio test $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$20, an additional condition $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$21, and a minimum of 50 good matches. Object localization uses cv::findHomography(..., RANSAC, 3.0) and cv::perspectiveTransform.

The Android-side architecture includes MainActivity, ColorActivity, ShapeActivity, FeatureActivity, a Camera/Gallery helper, and an OpenCVBridge Java–JNI wrapper. Gallery loading uses ACTION_PICK, camera capture uses ACTION_IMAGE_CAPTURE, OpenCV is loaded by System.loadLibrary("opencv_java3"), and AsyncTask is used to keep processing off the UI thread. Reported performance on Galaxy S3, S6, and Note 1 includes 11/11 colors detected on uniform backgrounds, average 10.1/11 on complex backgrounds, 4/4 standard shapes on uniform backgrounds, and BRISK matching success of 100% for scaled objects, 100% for rotated objects, 95% for viewpoint changes, and 100% for faces. For a $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$22 image, the S6 latencies are $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$23 for color, $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$24 for shape, and $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$25 for features.

This usage is conceptually unrelated to Android malware analysis. The commonality is only nominal: the system detects visual patterns rather than malicious behavior.

6. DroidDetect for AI-generated code detection

The 2025 work titled “$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$26: A Resource Suite for AI-Generated Code Detection” introduces $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$27 as a suite of encoder-only detectors trained on $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$28, a corpus of over $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$29 code samples across seven programming languages and three real-world coding domains (Orel et al., 11 Jul 2025). The collection spans 11 model families and 43 model variants from 2B to 72B parameters. Its class distribution is approximately 265,000 fully AI-generated samples, 138,000 human–AI refined samples, 159,000 adversarially humanised samples, and 498,000 human-written samples.

The detector architecture uses ModernBERT-Base with 149M parameters and ModernBERT-Large with 396M parameters. Code is tokenized with the ModernBERT tokenizer and truncated or padded to $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$30 tokens. Classification uses the final-layer $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$31 embedding $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$32, dropout with $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$33, and a linear layer to $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$34 classes:

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$35

The base loss is cross-entropy,

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$36

and the optional metric-learning extension adds a triplet loss

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$37

with squared Euclidean distance, margin $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$38, and example weight $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$39 in

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$40

A major emphasis is adversarial robustness. The work constructs prompt-based attacks such as “Please write this code like a human,” and a preference-tuned dataset, DroidCollection-Pref, with 157k human/LM-generated response pairs. LLaMA, Qwen, and Yi models up to 9B are fine-tuned with LoRA + DPO for 2 epochs, producing machine-humanised code. Approximately 159k adversarial samples are then merged into training in a 1:1 ratio of prompt-based and preference-tuned examples. Reported recall on adversarial samples rises to $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$41 for both DroidDetect-Base and DroidDetect-Large after adversarial training, whereas pre-adversarial DroidDetect-Base ranges from $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$42 to $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$43.

Two additional training refinements are reported. Metric learning raises weighted $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$44 in the 3-class setting from 94.36 to 94.43. Uncertainty-based resampling computes predictive entropy,

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$45

removes the top 7% most uncertain human-written samples, and yields slight but consistent gains. At evaluation time, DroidDetect-Large reports weighted $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$46 averages of 97.00 for 2-class and 88.78 for 3-class domain-level settings, with language-level averages of 99.23 and 93.66 respectively. The paper also reports out-of-distribution drops of 10–40 $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$47 points when training on one domain and testing on another, indicating that generalization depends strongly on diversity of training data.

This version of DroidDetect is technically far removed from Android security. Its inclusion under the same name shows that the label migrated from mobile-app contexts to code-authorship attribution and AI-generated-content forensics.

7. Position within adjacent Android detection research

The Android-malware uses of DroidDetect and Droidetec sit within a broader ecosystem of behavioral modeling, graph abstraction, and static–dynamic comparison (Ikram et al., 2019, Onwuzurike et al., 2018). DaDiDroid models each application as a weighted directed graph $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$48 over API calls or API families, with edge weights

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$49

extracts $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$50 structural metrics, and feeds the resulting vector to supervised classifiers, with Random Forest performing best. Its reported results include approximately 95.7% precision, recall, and $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$51, and 96.5% accuracy on the full Marvin dataset, as well as approximately 91.2% accuracy under obfuscated-only training. This provides a graph-statistical alternative to Droidetec’s sequence model.

“A Family of Droids” compares static MaMaDroid, dynamic AuntieDroid, and hybrid variants under a common Markov-chain abstraction over API-call sequences. Transition probabilities are estimated as

$$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$52

flattened into a feature vector, and classified by Random Forest. The reported result is that hybrid analysis matches or outperforms pure static or dynamic analysis, with best overall $$R_{\mathrm{from}}(m_i)=\{m_j\in M\mid m_i \text{ directly invokes } m_j\}$$53 in package mode. The same study states that static analysis is at least as effective as dynamic analysis, depending on app stimulation, and highlights that dynamically loaded code is extremely prevalent.

These neighboring systems clarify what is distinctive about Droidetec. A plausible interpretation is that Droidetec occupies the sequence-learning end of Android malware detection: it preserves API order, learns dense embeddings, and reuses attention for localization. DaDiDroid instead emphasizes graph topology and obfuscation resilience, while MaMaDroid and AuntieDroid emphasize abstract transition statistics under static, dynamic, and hybrid regimes. The broader literature therefore does not support a single “DroidDetect paradigm”; it supports several competing representational choices whose relative strengths depend on whether the priority is code localization, obfuscation robustness, runtime coverage, or cross-domain generalization.