Resource-constrained devices, such as Android smartphones, cannot currently benefit from protection through application monitoring, since usual approaches are too resource intensive. To develop an efficient and effective solution suitable for mobile devices, we propose to monitor only those aspects of application execution that are potentially security-critical. The aim of this work is to support developers in instrumenting security-critical code fragments in their applications, so that they can be monitored dynamically. In this paper, we present our approach to characterizing and dynamically instrumenting these fragments in Android application code. As a proof of concept, we show the efficacy of machine learning-based malware detection using the identified fragments as input. Our evaluation indicates the ability to detect various kinds of threats in instrumentation-based attack detection, enabled by automated dynamic analysis, and focuses in particular on the savings potential offered by our filtering approach.