Table 7. Machine learning and its classifier used in studies.

Machine learning types supervised and unsupervised with the classifier and the respective articles. To detect Android malware with static features, the supervised learning method is widely used by security practitioners.

Machine learning type	Classifier	Reference
Supervised	K-nearest neighbor	Anonymous (2019b); Aafer, Du & Yin (2013)
	Support vector machine (svm)	Aafer, Du & Yin (2013); Sahs & Khan (2012); Huang, Tsai & Hsu (2012); Arp et al. (2014); Anonymous (2019b); Anonymous (2019d); Arp et al. (2014)
	CART	Aung & Zaw (2013)
	Adaboost	Huang, Tsai & Hsu (2012); Sheen, Anitha & Natarajan (2015)
	Bayes	Yerima, Sezer & McWilliams (2014); Lee, Lee & Lee (2015); Hao Peng et al. (2012); Sanz et al. (2013); Shabtai, Fledel & Elovici (2010)
	Logistic Regression	Talha, Alper & Aydin (2015)
	Prism (PART)	Aubrey-Derrick Schmidt et al. (2009a); Yerima, Sezer & Muttik (2014); Shabtai, Fledel & Elovici (2010)
	Voting feature interval (vfi)	Shabtai, Fledel & Elovici (2010)
	Random forest	Shabtai, Fledel & Elovici (2010); Sanz et al. (2013); Aafer, Du & Yin (2013); Huang, Tsai & Hsu (2012)
	Sequential minimal optimisation (smo)	Sanz et al. (2013)
	Instance-based learning with parameter k (ibk)	Sanz et al. (2013)
	Simple logistic	Sanz et al. (2013)
	Multilayer perceptron	Firdaus & Anuar (2015)
Unsupervised	K-means	Fan et al. (2019); Wu et al. (2012); Samra, Kangbin & Ghanem (2013); Aung & Zaw (2013)
	Normalised Compression distance (NCD)	Lu et al. (2012); Crussell, Gibler & Chen (2012)