# DroidDetectMW: A Hybrid Intelligent Model for Android Malware Detection
## 5 Experiments
### Evaluation Measures and Experimental Setup  
Several measures are used to evaluate the classifiers' efficacy, such as Matthews correlation coefficient (MCC), precision, F-measure, true positive rate (TPR), Area under curve (AUC), and false positive rate (FPR). The evaluation measures are based on false positive (FP), true negative (TN), true positive (TP), and false negative (FN). We used 20% of the data during the experiment for testing, while 80% was for training. The following Equations provide further information. The experimental computing setup is listed in Table 3. For dynamic features, it also shows that certain families of malware are tailored to ARM devices and hence cannot run on x86 emulation. Consequently, in such scenarios, the use of emulator sandboxes for studying and detecting these families becomes impractical, restricting the effectiveness of emulators as platforms for forensics and detection. * TPR--Recall: It is calculated by dividing the number of confirmed positive results by the total number of positive results. As illustrated in Equation, it can be estimated by Equation (14): \[\textbf{TPR}=\frac{\textbf{TP}}{\textbf{TP}+\textbf{FN}}\] (14)
* FPR: This metric represents the proportion of false positive cases relative to the total number of true negative cases. The calculation is described by the following Equation (15): \begin{table}
\begin{tabular}{c c c} \hline \hline
**Malware Family Types** & **Malware Category** & **\# of Samples** \\ \hline Ewind & Adware & 154 \\ Kemoge & Adware & 153 \\ Dowgin & Adware & 176 \\ Zsone & SMSmalware & 105 \\ Isust & Ransomware & 117 \\ Sypeng & Ransomware & 116 \\ AndroidDefender & scareware & 133 \\ FakeAV & scareware & 103 \\ Penetho & scareware & 142 \\ Biige & SMSmalware & 174 \\ SMSsniffer & SMSmalware & 181 \\ Youmi & Adware & 164 \\ Gimmaster & Adware & 192 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Malware family types used. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Dataset** & **Number of Samples** & **\#of Malware Samples** & **\# of Benign Samples** \\ \hline Drebin & 1400 & 450 & 950 \\ CICAndMal2017 & 1240 & 450 & 790 \\ APK Mirror & 1200 & 410 & 790 \\ VirusShare & 1050 & 600 & 450 \\ Total & 4890 & 1910 & 2980 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Distribution of used samples of dataset. \begin{table}
\begin{tabular}{c c} \hline \hline
**Setting** & **Parameter** \\ \hline PU & Intel(R) Core(TM)i7-2.40 GHz \\ Operating System & Windows 10 Home Single \\ GPU & NVIDIA 1060 \\ RAM & 32 GB \\ Python Version & 3.8 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The experimental environment settings. \[\textbf{{F}}\textbf{{P}}=\frac{\textbf{{F}}\textbf{{P}}}{\textbf{{T}}\textbf{{N}}+ \textbf{{F}}\textbf{{P}}} \tag{15}\]
* Precision is calculated by dividing the number of correct predictions by the total number of correct predictions. It can be calculated by Equation (16): \[\textbf{{Precision}}=\frac{\textbf{{T}}\textbf{{P}}}{\textbf{{T}}\textbf{{P}}+ \textbf{{F}}\textbf{{P}}}\] (16)
* F-measure: It indicates the harmonic mean of precision and recall. Equation (17) is used to deter-mine this is: \[\textbf{{F}}-\text{measure}=\frac{\textbf{{2}}\times(\text{Precision}\times \text{Recall})}{(\text{Precision}+\text{Recall})}\] (17)
* Accuracy: It is calculated by dividing the number of cases by the sum of the instances that are both true negatives and true positives. Equation (18) used to determine this is: \[\text{Accuracy}=\frac{\textbf{{T}}\textbf{{P}}+\textbf{{T}}\textbf{{N}}}{ \textbf{{T}}\textbf{{P}}+\textbf{{F}}\textbf{{P}}+\textbf{{F}}\textbf{{N}}+ \textbf{{T}}\textbf{{N}}}\] (18)
* MCC: It is a standard for evaluating the efficacy of binary classifiers. Its numerical value ranges from \(+1\) to \(-1\). Here, a value of \(+1\) indicates an exact prediction, while a value of \(-1\) indicates an opposite forecast.