# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 7 Conclusions and Future Work  
In conclusion, this paper discussed a specific family of malware called ransomware by highlighting its characteristics and general behavior. This research discussed the impact of dynamic analysis on ransomware detection accuracy in Android systems. Initially, we determined the shortcomings of the literature, and define our study's contribution, with a detailed discussion regarding the current status and the availability of the tools utilizing static and dynamic approaches. Therefore, this paper introduced a hybrid-based system  
Figure 9: A case study of ransomware apps that invokes intent to lock the victim device.  
that integrates the advantages of both static and dynamic analyses to guarantee accurate detection of Android ransomware. These two types of analyses were executed efficiently. The hybrid system starts with static analysis, and based on its detection performance, the system can decide whether to proceed with the dynamic analysis. In addition, we conducted a deep study to choose proper tools to inject into the proposed hybrid system. Subsequently, we chose VirusTotal as a static analyzer and MobSF as a dynamic analyzer. The comparison results showed that static analysis using VirusTotal achieved almost half of the detection accuracy--ranging from around 40-55%, compared to the dynamics-based analysis using MobSF that succeeded in achieving a 100% accuracy rate. We evaluated the results of the analysis detection by implementing some specific evaluation metrics, such as the ransomware detection accuracy and the methods, classes, and permissions frequencies, to determine the proposed approach's effectiveness.  
Moreover, this research reported some of the most-used API classes and methods used in ransomware apps, such as _javax.crypto.Cipher, javax.crypto.spec.SecretKeySpec_, and its _method doFinal()_ and _$init()_, which came in second and third places, respectively. In addition to the highly used permissions generated from the static analyzer for both VirusTotal and MobSF, they were able to detect the frequency of the permission _an-droid.permission.WRITE_EXTERNAL_STORAGE_ as the most used permission. The permissions _android.permission.INTERNET_ and _android.permission.ACCESS_NETWORK_STATE_ came in second and third places in terms of frequency, indicating that most ransomware apps need to have this permission to write on external devices and connect to the internet to complete the locking or encryption processes. Finally, some case studies were highlighted, including failed running apps and crypto-ransomware patterns.  
As future work, other dynamic-based analysis tools can be tested. New ransomware apps can be collected and analyzed. Machine learning techniques can be applied to the results' reports and features generated by both static and dynamic analyses to detect new ransomware apps. Additionally, other ransomware behavior patterns can be observed and analyzed.  
Conceptualization, R.A. and I.A.; methodology, R.A. and I.A.; software, R.A., I.A. and A.A.; validation, R.A. and I.A.; formal analysis, R.A. and I.A.; investigation, R.A. and I.A.; resources, R.A. and I.A.; data curation, R.A., I.A. and A.A.; writing--original draft preparation, R.A. and I.A.; writing--review and editing, R.A., I.A. and A.A.; visualization, R.A., I.A. and A.A.; supervision, I.A.; project administration, I.A.; funding acquisition, I.A. All authors have read and agreed to the published version of the manuscript. The article processing charges (APC) was funded by Prince Sultan University (PSU). The authors would like to thank PSU for paying the APC of this publication. Moreover, this research was done during the author [PERSON]'s sabbatical year 2021/2022 from the University of Jordan, Amman - Jordan. The authors declare no conflict of interest.