## 3 Materials and Methods
### Dynamic Model Proposed for Android Malware Detection
#### 3.2.4 Multi-Classification
In ensemble models, the results are generally aggregated through several statistical techniques such as Bagging and voting. In this study, the Bagging technique is used to combine the results obtained from the decision trees. This method's first step involves uniformly sampling the initial dataset to create a new dataset of the same size. Then, each instance in the dataset is authorized to grow a set of decision trees. The probability of new data points is established in the following step using the class distributions, following the independent training of each tree in the decision forest [45]. The class probability of the decision forest is obtained by averaging the class probabilities of all of the trees, as shown in Equation (5). \[p(c|v)=\frac{1}{T}\sum_{t}^{T}p_{t}(c|v) \tag{5}\]  
Here, \(c\) represents the class label, \(v\) represents the new input vector, \(T\) represents the number of trees in the ensemble and \(p_{t}(c|v)\) represents the class probability of each tree. Classifier 4: The two-class LR method is a supervised learning algorithm widely used in classification problems. When the variable to be estimated is categorical, it is preferable to linear regression. The method for resolving two-class problems involves fitting the training data for the binary event into a logistic function, and then estimating the probability of the categorical dependent variable in accordance with that estimate [46,47]. Equation (6) can be used to obtain the logistic regression model's conditional probability. \[\pi(x_{i})=P(Y=1|x_{i})=\frac{e^{(\beta_{0}+\beta_{1}x_{1})}}{1+e^{(\beta_{0}+ \beta_{1}x_{1})}}=\frac{1}{1+e^{-(\beta_{0}+\beta_{1}x_{1})}} \tag{6}\]  
In this equation, \(\beta^{\prime}=\left[\beta_{0},\beta_{1},\ldots,\ \beta_{p}\right]\) represents the vector of the unknown parameters, \(x_{j}\) represents the \(p\times 1\) dimensional vector of the arguments and \(\pi(x_{i})=P(Y=1|x_{i})\) represents the conditional probability of the model. The parameter estimates are obtained by maximizing the log-likelihood function obtained from this equation. By maximizing the log-likelihood function derived from this equation, the parameter estimations can be obtained. Classifier 5: Using the kernel approach, the two-class BPM method successfully transforms a linear Bayesian classifier into a nonlinear classifier. The basic principle of the BMP method in classification is based on finding the Bayesian point, which is the center of this space, among the possible solutions in the version space created by a set of hypotheses for a certain set of training data. Each hypothesis in the version space corresponds to a classifier that assigns input vectors to the output vectors [47]. The BMP is trained with m-dimensional training data, \(z=(x,y)=(\{x_{1},y_{1}\},\ldots\ldots,\{x_{m},y_{m}\})\), where \(h(x)\) is the function representing the hypothesis for an input vector x. Equation (7) describes how the version space \(V(z)\) of BMP is created. \[V(z):=\{h\in H|\forall_{i}\in\{1,\ldots\ldots,m\}:h(x_{i})=y_{i}\} \tag{7}\]  
Equation (8) illustrates the Bayesian method's approach, which labels a test instance provided to it throughout the classification process with the lowest loss in accordance with the posterior probability \(P_{H\setminus Z^{m}=z}(h)\). \[Bayes_{z}(x):=arg_{y\in Y}^{min}E_{E\setminus Z^{m}=z}[l(H(X),y)] \tag{8}\]  
In this approach, the loss value is obtained through the function given in Equation (9). \[l(y,y)= \begin{cases}\hat{0}&y=\dot{y}\\ 1&y\
eq\dot{y}\end{cases}  \tag{9}\]  
Classifier 6: The two-class BDT is a form of EL where each tree corrects the classification mistakes of the one before it. It is implemented to solve both the classification and regression problems. Predictions are made on the basis of the entire tree community. By iteratively combining each weak learner, the BDT algorithm seeks to create a single strong learner. For this purpose, the algorithm first creates an empty weak learner community.