## 3 Materials and Methods
### Dynamic Model Proposed for Android Malware Detection
#### 3.2.4 Multi-Classification  
This process collectively generates performance scores at the end of the training and testing phases of six different ML-based classifiers. The initial step of the multi-classification process is training the classifiers using the data from the data splitting process. Subsequently, a performance score in the range of \"0-1\" is calculated for each classifier by testing the trained models using the test data. Binary form classifiers are utilized in the related process since the data are received in one out of two classes; they are either benign or malicious. As for the classifiers, a two-class LR, a two-class BPM, a two-class BDT, a two-class NN, a two-class DF and a two-class SVM, which are known to perform well in binary classification problems, are used. Classifier 1: The two-class NN is a binary classification algorithm that consists of a series of layers containing nodes that transmit information to each other. It is typically represented by a structure that combines an input layer, an output layer and one or more hidden layers. The input layer is used to transmit input data to the network. The hidden layer(s) processes the incoming data over the nodes using the weights between itself and the input layer, and then it sends it to the output layer. The input layer's weighted data are processed in a node element by the output layer, which then produces the classified results. Following the model training, the relationship between the inputs and the outputs can be discovered by passing the transfer function [42], which computes the sum of the weighted inputs from the network's previous layers, through an evaluuator, whose activation function is given, as shown in Equation (2). \[Output=f\left(\sum_{i=1}^{n}x_{i}*w_{i}+b\right) \tag{2}\]  
Here, \(x_{1}\), \(x_{2},\ldots x_{n}\) represents the incoming inputs from the previous layer, \(w_{1}\), \(w_{2}\ldots\ldots\ldots w_{n}\) represents the connection weights of the inputs, \(b\) represents the bias value and \(f(. )\) represents the activation function. The step function, the sigmoid function and the ReLU function are commonly used as activation functions. Classifier 2: The two-class SVM is a supervised learning method widely used in solving linear or nonlinear binary classification problems. This method, which was introduced in [43] for the solution of pattern recognition and classification problems, is used to manage both the linear and nonlinear classification processes. In the classification process of nonlinear problems, it makes use of several kernel-based functions such as linear kernel, polynomial kernel and radial basis ones, which are called kernel functions. Finding the hyperplane that maximizes the decision boundary to two classes labeled from any point in a vector space with training data forms the basis of the classification process in linear SVMs [44]. The points closest to the decision boundary are referred to as \"supports\" in this context, and the distance between the relevant supports is referred to as the \"margin\". As the margin increases, the discrimination between the classes will increase. The SVM for each input with feature D in a space with n data points can be given by Equation (3). \[\left\{x_{i},y_{i}\right\}\left|i=1\ldots n,\;y_{i\in\left\{-1,+1\right\}},x \in\Re^{D}\right. \tag{3}\]  
In this equation, the response variable is represented by \(y_{i}\), an element from one of the classes \(-1\) or \(+1\), and \(x_{i}\), an element of the input vector (real vector). The hyperplane that increases the distance between the classes \(-1\) and \(+1\) can be calculated using Equation (4). \[w.x-b=0 \tag{4}\]  
The hyperplane offset, or the difference in the distance between the two classes, is represented by the value of \(b/\left|\left.w\right|\right|\), where \(w\) is the normal vector perpendicular to the hyperplane. Classifier 3: The two-class DF is an ensemble learning model based on the principle of combining the results of independent decision trees that perform as well as possible individually.