## 4 Proposed Framework for Android Ransomware Detection
### Datasets Description and Preparation  
Primarily, the constructed dataset encompasses features of the application permissions and API calls that were obtained by a reverse engineering procedure. Executable mobile applications come in the Android package kit (_apk_) extended file, which is a package file that is used by end-users to install mobile applications on the Android operating system. Mainly, it contains all the needed files during development including classes, resources, assets, certificates, libraries, and the manifest file. Two essential types of files are needed to extract the features of permissions and the API calls; which are the (AndroidManifest.xml) and (\".smail\") files. The (AndroidManifest.xml) file is a fundamental file that consists of all the permissions that were used by the corresponding application. Whereas, the (\".smail\") files acquired by disassembling (balsmaling) the binary executable files (\".dex\"). The Apktool software is a tool that automates the process of unpacking the APK files and attains the manifest and Smali files [41]. The creation of the dataset was performed by collecting 1000 (_apk_) files from benign and ransomware mobile applications. The benign applications were downloaded from the Google Play store, whereas, the ransomware apps were collected from HelDroid project, RansomProper project, Virus Total, and Koodous tools [14; 20; 42; 43]. In order to unpack the AndroidManifest files and Smali files from all used applications; the Apktool (version = 2.3.1) was employed. Afterward, regarding the permissions features, the extracted files were scanned to report the presence of 131 types of permissions. The objective of the Android permissions is to inform the user and to have an acceptance  
Figure 3: An illustration of an intelligent Android ransomware detection system. to use sensitive data from the user's mobile or access some system features (such as the camera). Typically, by default, the applications do not have permission to execute actions that might have a negative effect on the user, the system, or the installed mobile applications. Such permissions prevent the applications from accessing a user's emails, keeping the device awake, or writing on the files of other applications. All the permissions which are (131) were scanned from the thousand AndroidManifest files and documented for further analysis. However, (16) permission features were removed from the original dataset since they are not used by the benign or ransomware classes. Regarding the features from the API calls, they were considered from the Oreo Android release (Android API 27), which contains (199) API packages. All the respective applications were decompiled using the Apktool and the files with (\".smali\") extension were extracted. The \".smali\" files were scanned to find the occurrences rate of API calls from both benign and ransomware applications; hence to be handled as distinguishing features. For instance, examples of used features of the API calls are Android Animation and Android Content. In consequence, the total dataset accounts for (1000) applications; where (500) are benign and (500) are ransomware. The total number of features is (314) of both the permissions and the API calls. Frequency analysis is performed on the extracted features to indicate the occurrences of features with regard to the benign and ransomware classes, Figure 4 shows the frequency of permission features in benign and ransomware applications, where the features with a frequency less than or equal to 2% were eliminated. Obviously, the top four features observed by benign applications were the access_network_state, Internet, wake_lock, and write_external_storage, even that they were highly witnessed by the ransomware apps, too. On the other hand, the receive_boot_completed, and the read_phone_state were considerably occurred by the ransomware applications. Nonetheless, the figure shows (6) features used slightly just by the benign apps, while (12) features used only by the ransomware.