# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 2 Related Works
Talos checks whether the application performs specific actions with additional instructions; therefore, it can locate the code to determine the malicious behavior. Moreover, the system is robust against obfuscation techniques. However, since the authors manually crafted the logic rules that were employed in the detection system, it was a time-consuming process. The study conducted by [PERSON] et al. [11] resulted in building a hybrid framework that first reviews the application statically. If the results seem to be suspicious, then it sends it to be dynamically analyzed. The static analysis was performed by implementing deep learning algorithm to extract some common features, such as API calls, app permissions, text and image classifications. At the same time, dynamic features include the sequence of API calls during the runtime to match it with the malicious behavior of ransomware. This approach, however, lacks the ability to detect malware that applies obfuscated techniques since it might avoid undergoing the dynamic analysis. Another recent real-time detection system, named RansomProber, was introduced by [PERSON] et al. [20]. This system monitors device-sensitive files and determines the user's intention and finger movements by analyzing the UI widgets of the related operation during the running time of the application. One challenge facing this approach is the user-intent analysis since it is difficult to detect slight differences between encrypting ransomware and a benign application with an encryption function. [PERSON] et al. [21] presented a framework for Android static analysis, \"ASAF\". The proposed framework models the process of analyzing the apps statically without running them by implementing the Android static parse \"ASParse\" tool, which extracts static features and stores them according to a defined schema. [PERSON] et al. [22] proposed a lightweight detection system that is based on six extracted features from multiple sources to identify the locker ransomware behavior. The authors then used four classifiers--support vector machine (SVM), decision tree (DT), random forest (RF), and logistic regression (LR)--in order to classify whether the application is benign or not. Furthermore, a proactive permissions-based ransomware detection system was introduced by [PERSON] et al. [23]. The system tests different classifiers to detect the ransomware before it is invoked--to ensure high accuracy detection. Additionally, [PERSON] et al. [24] illustrated the design of a detection system by discarding the system message log of the racked ransomware; however, the study did not implement the proposed approach. Table 1 shows an overview of the existing ransomware approaches that were mentioned in this section, summarized by the approach type, features used in the analysis, and availability. After in-depth analysis of the literature, it was apparent that there were certain limitations in the previous studies. We considered that little related work had discussed Android ransomware specifically. These works mainly applied the static analysis detection approach. Furthermore, since ransomware can evade static analysis through code obfuscation techniques, dynamic analysis becomes essential. However, the current dynamic analysis tools are focused mainly on malware rather than ransomware. Additionally, some tools are not mature enough, are outdated, or are only available for commercial use. Therefore, there is a need to propose a hybrid system that investigates the impact of integrating both static and dynamic analyses to efficiently and accurately detect Android ransomware and protect Android users from being victims of this type of attack. This hybrid system should include several existing static analysis approaches and check their accuracy in discriminating ransomware apps from other benign apps. Based on the static analysis results, it will be decided to apply further dynamic analysis for these apps. The selection of the proper tools to run the dynamic analysis should be deeply studied.