Deep Learning Approaches on Image Representations of Android Malware: A Review

Abstract

This review highlights the shift from traditional static analysis to graph-driven, vision-based, and transformer-oriented approaches in deep learning-based and hybrid multimodal Android malware detection from 2023 to 2025.  This review uses a variety of related studies from Elsevier, IEEE Xplore, and ScienceDirect to examine ten representative approaches chosen for their methodological diversity and contributions to visual, hybrid, and interpretable detection frameworks.  End-to-end image models that convert DEX bytecode into grayscale or RGB matrices, graph-attention and multimodal fusion techniques that combine structural and semantic features, and deeper architectures like 3D-CNNs and Vision Transformers that are capable of capturing multiscale contextual patterns are representative approaches. The surveyed works also include a number of explainable AI techniques using SHAP or Grad-CAM, as well as lightweight learning frameworks aimed at reducing model complexity. All things considered, there is a noticeable shift from manually created static features to automatically learned image-centric representations. For instance, graph-based models reach up to 99.5% accuracy, whereas CNN models like MADRF-CNN achieve between 96% and 98%. The remaining issues are adversarial robustness, computational cost, and dataset imbalance. Lightweight CNN-Transformer hybrid detectors, the development of balanced benchmarks with adversarial and obfuscated samples, and a more thorough integration of explainability within multimodal learning for real-time usability and robustness enhancement are the main focuses of emerging research directions. The idea that the next generation of scalable and robust Android malware defense systems has been propelled by the convergence of visual computing, graph reasoning, and explainable AI is supported by these trends taken together.