# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 2 Related Works  
This section presents previous research studies that aimed to increase Android mobile protection and mitigate ransomware threats. Android ransomware is considered an important research topic; however, there is little related work that has discussed ransomware specifically. Ransomware researchers have attempted to address the behavior of the suspected applications from multiple views, such as checking API information, extracting features, monitoring, and tracking applications activities. [PERSON] et al. [13] presented a new approach to detect Android ransomware which depends on machine learning techniques, using binary particle swarm optimization algorithm to tune the hyper-parameters and perform feature selection. The support vector machine (SVM) and synthetic minority oversampling technique (SMOTE) were utilized for classification. The evaluated approach SMOTE- t BPSO-SVM was reported to achieve the highest Gmean, sensitivity, and specificity. [PERSON] et al. [14] presented a tool that dynamically monitors the read and write accesses to the file systems in Android devices. The proposed tool utilizes statistical methods to detect the abnormal processes of the Android operating system based on processor usage, memory usage, and I/O rates. However, this system fails to detect ransomware variants with threatening text and performs file locking. In addition, no implementation is available for public use. In addition, [PERSON] et al. [15] discussed their solution \"Sdguard\" in an attempt to enforce privacy protection as well as ransomware detection in Android mobile systems. The proposed solution monitors Android and the access control list activities by employing a supervised permission control depending on Linux discretionary access control (DAC) and using the FUSE file system. However, the system has no publicly available implementation. On the other hand, [PERSON] et al. [16] developed a lightweight hybrid framework that utilizes static and dynamic analysis under the name \"RanDroid\". The developed system is specialized in detecting ransomware variants. RanDroid takes advantage of the fact that ransomware notifies victims by displaying messages on their machines. Thus, it measures the structural similarity between a predefined set of threatening images and text with the sample from the ransomware variant, consequently being able to classify the sample as ransomware or benign. Moreover, [PERSON] et al. [17] presented HelDroid, a system that combines taint analysis to detect file encryption behaviors with symbolic evaluation. HelDroid identifies if the app seeks to lock or encrypt the mobile device without the user's permission, or a threatening payment demand is displayed on the screen. However, HelDroid has an apparent vulnerability to samples that utilize evasion mechanisms. Furthermore, authors [PERSON] et al. [18] pursued to improve the HelDroid detection system. The improved system is called GreatEatlon, which reduces the detection speed significantly. The proposed tool includes various text classifier systems combined with taint analysis, achieving an accuracy rate of 99%. However, the system can only classify whether the application is malware or benign, with no further indication of its kind of malware. In addition, R-PackDroid [19] is another attempted solution to detect Android ransomware based on the extracted API packages information. The proposed application is a supervised machine learning-based program that utilizes the random forest classifier and executesit on Android mobiles directly. This approach has an advantage over the previously mentioned two approaches (HelDroid and GreatEatIon) by overcoming the language barrier of the ransomware applications. A limitation of this approach is that there is a possibility of evading detection at runtime if the ransomware is equipped with strategies derived from adversarial machine learning. [PERSON] et al. [10] implemented a system called Talos that detects ransomware based on formal methods.