## 3 The Proposed Model
### Malware Detection Using ARAE Model  
To detect and classify Android malware, the ARAE model is exploited. [PERSON] et al. [25] first created a long short-term memory (LSTM) cell by setting a long-time delay among the feedback, input, and gradient burst of the classical RNN module. An underlying concept of LSTM is to include the infrastructure of the cell state, input, forget, and output gates. The concrete calculation process and working principle of gate structure have been discussed in the following.  
(1) Forget Gate: Firstly, the LSTM network links \(h_{t-1}\) hidden state and \(x_{t}\) input to \([h_{t-1},\ x_{t}]\). The vector \(f_{t}\) is computed to characterize how much data need to be \"forgotten\" from the \(C_{t-1}\) cell state at \(the\ t-1\) time.  
\[f_{t}=\sigma\Big{(}W_{f}\cdot[h_{t-1},\ x_{t}]+b_{f}\Big{)} \tag{11}\]  
where \(\sigma\) indicates the sigmoid function, \(W_{f}\) denotes the weighted vector of \"forget gate\" and \(b_{f}\) shows the offset values of the forget gate.  
(2) Input Gate: It computes cell state \(\widetilde{C}_{t}\) to be inputted according to the input dataset \([h_{t-1},\ x_{t}]\) and similarly, calculates the vector to control how much data need to be inputted into the cell state \(\widetilde{C}_{t}\).  
\[\widetilde{C}_{t}=tanh\ (W_{C}\cdot[h_{t-1},\ x_{t}]+b_{C}) \tag{12}\]  
\[i_{t}=\sigma(W_{i}\cdot[h_{t-1},\ x_{t}]+b_{i}) \tag{13}\]  
where \(\widetilde{C}_{t}\), \(W_{C}\), and \(b_{C}\) characterize the value of cell state to be inputted from novel inputs, the upgraded weight of cell state, and cell state bias value, correspondingly. The resultant vector, weight matrices, and bias value of inputted gates are represented as \(i_{t}\), \(W\), and \(b_{i}\), correspondingly. Figure 3 depicts the framework of ARAE.  
(3) Cell Status: The cell state updating can be defined at \(t-1\). Afterwards, the computation outcomes of the forget gate \(f_{t}\), the dataset \(C_{t-1}\) that is forgotten are defined [26]. Next, \(\widetilde{theC}_{t}\) cell state is produced by the dataset at \(t\) time. With the computation result of the input gate, we adjust to define how much data will be inputted, and updating function of the \(C_{t}\) cell state at \(t\) time is  
\[C_{t}=f_{t}\times C_{t-1}+i_{t}\times\widetilde{C}_{t}. \tag{14}\]  
(4) Output Gate: The output \(0_{t}\) of the LSTM was computed using the \"output gate.\" Next, the cell state \(C_{t}\) at \(t\) time defines what data in the output are eventually transferred, and the results of the last output are \(h_{t}\).  
\[o_{t}=\sigma(W_{o}\cdot[h_{t-1},\;x_{t}]+b_{o}) \tag{15}\]  
\[h_{t}=0_{t}\times tanh\;(C_{t}) \tag{16}\]  
where the output vector, weight vector, and offset values of output gate are represented as \(0_{t}\), \(W_{o}\), and \(b_{o}\), correspondingly. The resultant values of the LSTM at \(t\) time are represented as \(h_{t}\).  
An autoencoder (AE) is an unsupervised technique that encompasses the encode and decode process. Usually, it is exploited for feature extraction or dimension reduction. The LHS of the encode processes learns its inherent feature vector \(H\) from the raw input dataset X such that the encoder is denoted as \(=f(X)\). The learning technique is understood to be that which reduces the cost function to guarantee minimal error among the raw inputs and the reconstruction dataset:  
\[min\;\{L(X,\;g(f(X)))\} \tag{17}\]  
In Equation (7), \(X\) indicates the input vector, \(f\) denotes the encoding procedure, \(g\) represents the decoding procedure, and \(L\) shows the cost function.