## 4 Proposed Framework for Android Ransomware Detection
### Model Evaluation Metrics  
Algorithm evaluation is a significant aspect of developing a successful classification model. Relying on one evaluation criterion might indicate a very good model, while in terms of another, it might reflect a deterioration in the algorithm performance capability. Typically, to properly measure the performance of the algorithms in handling the variable characteristics of the data, and for a fair comparison, as well; several evaluation metrics were considered.  
Herein, assessing the algorithm's ability in distinguishing between benign data or malware, generally, depends on a set of metrics derived from the confusion matrix. The confusion matrix reveals the potential of the algorithm in truly classifying the data with respect to its actual labels. It is expressed by four types of counts (given a binary classification problem); the true positive (TP), the true negative (TN), the false positive (FP), and the false negative (FN), as represented by Table 1. Therefore, this paper incorporates the accuracy, recall, false positive rate, specificity, precision, g-mean, and the area under the curve (AUC) for measuring the performance of the proposed algorithms. Mainly, those metrics are defined as follows by considering that the positive class is the class of interest, which is the Ransomware class.  
The accuracy is the ratio of the total number of classifications that were correctly labeled, it is shown by Equation (15).  
\[Accuracy=\frac{TN+TP}{TN+TP+FN+FP} \tag{15}\]  
Figure 7: A structural representation of the methodology flow that describes the process of searching for the optimal set of features and the best hyperparameters.  
Recall expresses the true positive rate, and formulated by the percentage of the relevant instances that have been identified over the total number of relevant instances. It is presented by Equation (16)  
\[Recall=\frac{TP}{TP+FN} \tag{16}\]  
False positive rate (FPR) also known as the false alarm rate, which is the ratio of classifying the benign instances as ransomware instances (Equation (17)).  
\[FPR=\frac{FP}{FP+TN} \tag{17}\]  
True negative rate (TNR) or the specificity, it exhibits the strength of the classifier in distinguishing the negatively classified instances of data (benign) from the positively labeled (ransomware) instances. The TNR is defined as in (Equation (18)).  
\[TNR=\frac{TN}{TN+FP} \tag{18}\]  
Precision is the proportion of the relevant data instances over the retrieved instances. It is mathematical description is given by Equation (19).  
\[Precision=\frac{TP}{TP+FP} \tag{19}\]  
The geometric mean (G-mean) represents the mean of the recalls in case of the multiple classes, or the mean of the recall and specificity in case of the of binary classification, it is defined by Equation (20).  
\[G-mean=\sqrt{\frac{TP}{TP+FN}\times\frac{TN}{TN+FP}} \tag{20}\]  
The area under the curve (AUC) is defined as the area under the receiver operating characteristic (ROC) curve. AUC is deemed as a metric for evaluating the ability of the classifier in discriminating between the respective classes. Thereby, obtaining a high value of AUC is an indication of the power of the model in differentiating between the ransomware and the benign classes. Whereas, in the case of low AUC value that is approaching (0,) it means that the classifier identifies the benign data as ransomware, and counterintuitively, the ransomware as benign. The AUC is described by Equation (21).  
\[AUC=\frac{(1-FPR)\times(1+Recall)}{2}+\frac{FPR\times Recall}{2} \tag{21}\]