## 2 Related Works  
In recent years, the ransomware attacks of mobile devices have grown dramatically, which lead to a significant need for developing efficient protective and defensive solutions. However, in the literature, several research studies have concerned with tackling the problem of ransomware detection over cellular or mobile networks and in particular over Android mobile networks. This section discusses thoroughly the recently proposed solutions for the detection of such a serious problem. One of the early implementations of Android ransomware recognition is HelDroid that developed by [PERSON] et al. [14]. HelDroid used three criteria for the detection of ransomware, where one of them is a text classification technique to detect either ransomware or scareware, However, HelDroid is an offline detection method that is computationally expensive. While in [15], implemented a ransomware detection called GreatEatlon, which consists of multiple detection modules like the text analysis and encryption detection methods. Even that GreatEatlon showed improved and faster identification of Android ransomware, but it is computationally demanding and relies heavily on the text classifier that might be broken by string encryption. Nonetheless, [PERSON] et al. [16] implemented a system to identify ransomware and goodware by observing continuously the conducted processes. While interestingly in [17], [PERSON] and [PERSON] designed a hybrid of static-based and dynamic-based environment for the detection of ransomware on Android, which is called Dna-Droid. The static part of the system depended on the classification of texts and images, as well as, analyzing the APIs calls and permissions. On the other hand, the dynamic part used a deep learning approach (autoencoder neural network) to detect the presence of ransomware by analyzing and classifying system call sequences. However, the Dna-Droid was not tested on real ransomware samples as well as did not consider the scalability issues. The process of scanning Android apps to conduct both static and dynamic analysis was detailed in [18; 19]. Nonetheless, [PERSON] et al. [20] deployed a ransomware detection system (RansomProper) that observes the execution of applications and the usage of user interface (UI) widgets to extract valuable features and perform real-time detection. Although, RansomProper showed a high-performance ability in detecting the malicious encryption of files but failed to achieve relatively low execution time. Furthermore, [21], [PERSON] et al. [21] introduced the use of Hidden Markov Models (HMM) and structural entropy for the detection of Android malware. The integration of HMM is for the recognition of the malware application, while the structural entropy is for identifying the malware family. Additionally, [PERSON] et al. [22] designed StormDroid system which is a machine learning-oriented approach for the detection of Android malware. StormDroid extracted four types of features; sequences and dynamic features, as well as API calls and permissions. However, the authors did not consider the influence of the number of collected features in the performance of the proposed approach. In [23], [PERSON] et al. [23] proposed IntelliAV that is an anti-malware system for Android. IntelliAV stands mainly on extracting a set of features (e.g. permissions, APIs, intents, and statistical features), which then are used by a TensorFlowForest algorithm to differentiate the malware class from the benign class. However, the authors stated some limitations of the proposed system as the inability to detect malware that uses javascript. Moreover, [PERSON] et al. [24] proposed a machine learning approach for Android malware detection (RevealDroid). RevealDroid extracts the features from applications' binaries and APIs, which then used by the support vector machines (SVMs) for the recognition of the malware. Meanwhile, the classification and regression trees (CART) algorithm was used for the identification of the malware family.