Google has outlined its process for finding malware via the Android Developers blog and discusses its Verify Apps safety protocol.
http://www.androidauthority.com/how-google-finds-malware-malicious-android-apps-743847/
* Google