# Deep Learning Based Android Anomaly Detection Using a Combination of Vulnerabilities Dataset
## 3 Methodology
### Android Malware Detection Based on Deep Learning  
Figure 5 presents our system architecture for Android malware detection using Deep Learning. In the training phase, the malware and benign behavior patterns are learned by the ANN [22]. The DL model was designed for learning the pattern with four hidden layers, a single input layer and a single output layer. Fully connected feed-forward deep neural network architecture with four hidden layers was utilised to implement the suggested approach. The rationale for limiting the number of hidden layers to four is the complexity of the design. Figure 5 shows the architecture of the DL algorithm and the number of nodes in each layer, and Figure 4 shows the overall model design. The description of mapping layers is as follows. Seventy-four neurons are used in the input layer to read the 74 features. The neurons are then linked to the first hidden layer, known as the dense layer, where a mathematical computation is performed using activation functions [22]. The ReLU activation mechanism was used in this case. Another non-linear activation feature that has  
Figure 4: Design Methodology for malware detection in Android. become common in the field of DL is the ReLU function. ReLU stands for Rectified Linear Unit. The key benefit of using the ReLU mechanism is that it does not simultaneously activate all neurons. The neurons are therefore disabled only if there is less than 0 in the output of the linear transformation. In addition, the 74 features were also mapped into 74 dimensions, and 74 dimensions are mapped into 32 dimensions in the second hidden layer. Thirty-two dimensions were mapped in 32 dimensions of the third hidden layer. Finally, their values were mapped to a single-dimensional output layer. Equations (2) and (3) define the activation function \(Y\). \[Y=\max(0,x)+bias \tag{2}\]  
where \(Y\) denotes the output, \(x\) denotes the data, and bias is used to train the neural network on malware and benign patterns. \[Weighted_{sum}=\sum_{i}W_{i}X_{i} \tag{3}\]  
where \(W_{i}\) denotes the weight applied to each input node and \(X_{i}\) denotes the input applied to each node. At the final output layer, the sigmoid function is applied to provide output values ranging from 0 to 1. A function of activation is defined by Equation (4). \[Sigmoid=\left(\frac{1}{1+e^{-x}}\right) \tag{4}\]  
Binary Cross Entropy loss function was used to compile the neural network model. \[BinaryCrossEntropy=Error(y,f(X)) \tag{5}\]  
where \(y=\text{actual values},f(X)=\text{predicted values}\). Furthermore, the weights are changed using the gradient descent optimizer [23]. It changes the parameters in such a way that the loss function can be reduced using Equation (6). \[X=X-\alpha\Big{(}\frac{\sigma}{dX}j(X)\Big{)} \tag{6}\]  
where \(X\) is the new updated weight, \(\alpha\) denotes the rate of learning, and \(f(X)\) denotes the cost function, which is a quadratic equation based on the 74 features extracted from Android applications. There are two primary hyperparameters that govern the network's architecture or topology, which are the number of layers and nodes found within each hidden layer. Systematic experimentation allows configuring these hyperparameters when solving a specific predictive modeling problem. We have increased the number of epochs until the model was able to correctly classify the inputs. In the test phase, the DL model is tested using 20% of the dataset. After training the model, we tested it using the remaining 3706 samples. The trained neural network model determines whether the provided APK file is malicious or benign based on the pattern. In the first experiment, the training phase results were significantly higher than the testing phase's, causing overfitting in the model. However, when we increased the number of samples in the dataset for both benign samples and malware samples, the overfitting was solved and the performance in the training phase was almost the same as that in the testing phase.