# Systematic Review: Malware Detection and Classification in Cybersecurity
## 2 Methodology
### Advanced Malware Detection Techniques
#### 3.6.9 Hybrid Approach to Mitigate Adversarial Evasion Attacks by Ransomware  
The article titled Mitigating adversarial evasion attacks of ransomware using ensemble learning by [PERSON], [PERSON], and [PERSON], published in Computers and Electrical Engineering, addresses ransomware detection on Android devices using ensemble machine learning techniques to mitigate adversarial evasion attacks. Ransomware remains a significant cybersecurity threat, extorting money from users by locking their devices and personal data, demanding ransom payment to restore access. Ransomware primarily targets Windows devices but also targets other operating systems, including Android. By the end of 2018, Android held over 86.8% of the total mobile phone market share, making it the most widely used mobile operating system. This makes Android a prime target for ransomware attackers, who often distribute malware through compromised applications available on third-party app stores.  
The proposed methodology combines static and dynamic analysis of Android applications to detect ransomware. Static analysis is based on extracting features such as permissions, text, and network-based features (IP addresses, email addresses, and URLs) from APK files. Dynamic analysis, on the other hand, examines application behavior during execution, monitoring CPU usage, memory usage, and system call logs. Static analysis involves decompiling the APK file to extract the aforementioned features. The Apktool tool is used to unpack the APK files into their individual resources. Permissions are extracted from the AndroidManifest.xml file, while text and network-based features are extracted from.dex files. These features are converted into feature vectors and used to train static ensemble machine learning models. Dynamic analysis is performed by running the applications in an emulated environment to record their runtime behavior. Tools such as Android Debug Bridge (ADB) and Strace are used to monitor CPU usage, memory usage, and system calls. Dynamic feature vectors are used to train dynamic ensemble models.  
Two separate ensemble machine learning models are used to classify applications based on their static and dynamic features. Each ensemble includes multiple classification algorithms such as Naive Bayes, Decision Trees, Random Forests, Support Vector Machines (SVM), Logistic Regression, and AdaBoost. These classifiers are combined using a voting method to assign the final label (ransomware or non-ransomware) to each application. An empirical evaluation was performed using 10-fold cross-validation to assess the effectiveness of the proposed model. The dataset included Android applications containing both ransomware and non-ransomware. The results showed that the proposed ensemble model achieved high accuracy in detecting and classifying ransomware, even in the presence of adversarial evasion attacks.  
The study demonstrates that combining static and dynamic features with ensemble machine learning techniques is effective for detecting ransomware in Android. This approach not only improves detection accuracy but also is resilient to adversarial evasion attacks, providing a robust solution for mobile device cybersecurity [68].