# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 1 Introduction  
For the past few years, the vast demand to obtain mobile devices has peaked. As of January 2020, more than 5.94 billion people used mobile phones worldwide ([[https://datareportal.com/reports/digital-2020-global-digital-overview](https://datareportal.com/reports/digital-2020-global-digital-overview)]([https://datareportal.com/reports/digital-2020-global-digital-overview](https://datareportal.com/reports/digital-2020-global-digital-overview)), accessed on 28 September 2021 ), with the Android operating system (OS) taking more than 73% of the market share [1]. Part of the massive popularity of Android is its ease of use and open nature. Such characteristics have attracted many companies and developers to invest in the development of Android applications. However, users have the privilege to download and install applications from unreliable sources and untrusted third parties. Consequently, allowing users to have full control over verifying the application's integrity makes it easy for cybercriminals to shift their attention toward the Android application market [2]. Attackers develop malicious software (malware), a type of mobile application used to infect a legitimate user's device. This malware can inflict harm on the user's device in multiple ways, such as risking and damaging the confidentiality, integrity, and availability of the target's data or the device itself [3]. Due to the similarities between the mobile platform and the traditional operating systems, the characteristics of personal computer (PC) malware are no longer limited to computers. With the worldwide popularity of the Android operating system for mobile devices, malware has taken a turn and can now infect those devices. There are multiple ways to infect a device, as malware comes in various forms that include, but are not limited to viruses, worms, scareware, and more [4]. Ransomware is a kind of malware that targets the victims' devices by either locking them or encrypting the users' files, then prompts the victims to pay money to unlock the devices or recover their files [5]. Ransomware attacks, such as WannaCry, Petya, NotPetya, Cerber, and Locky, have exploded in recent years, causing significant harm to individuals, companies, and even governments [6]. Furthermore, with the emergence of cryptocurrencies, such as Bitcoin, it has become relatively easy and more secure to guarantee that the attacker cannot be tracked [7]. Consequently, it is necessary for users to have a defensive mechanism against ransomware attacks. This mechanism is referred to as the automation of the ransomware analysis process. Automated ransomware analysis is a technique that is carried out either statically or dynamically. Static analysis is a direct and fast method accomplished by studying a ransomware sample's source code without running the application [8]. However, ransomware can evade static analysis through code obfuscation techniques. As a result, dynamic analysis can overcome this weakness since it can detect the ransomware's behavior during the execution of the application [9]. Furthermore, the irreversible nature of the ransomware attack demands early detection, as most of the current solutions depend on signature-based detection. This type of detection can discover whether an application is injected with ransomware or not by obtaining information about it first, such as its pattern, structure, or behavior. Then, it matches this information with what is stored in databases to state whether it is safe or not. However, existing research works [10; 11; 12] stress that ransomware attacks are challenging to be detected and prevented. This is because many of the current approaches are neither effective nor efficient for ransomware detection. Many of them lack the dependency on dynamic analysis and/or suffer from low accuracy detection. Therefore, this paper introduces a hybrid Android ransomware detection system that integrates the prominent influence of the dynamic analysis to the static analysis results.