# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 3 The Proposed Hybrid-Based Analysis for Ransomware Detection
### Systematic Review of Dynamic Analysis Tools
#### 3.1.2 Screening the Search Results  
The Android research field has a wide range of tools that are known in the security field, such as NowSecure [27] and App-Ray [28]. This section lists several tools mentioned in previous research papers or that are well-known in the security community to be used in the dynamic analysis for Android applications. The authors of [29] proposed SandDroid, a malware detection and classification method based on support vector machines (SVM), among other classifiers. SandDroid utilizes a set of specific features extracted from the AndroidManifest file. However, SandDroid statically analyzes the APKs in the sandbox instead of performing dynamic analysis. Another dynamic analysis tool developed by NVISO ([[https://apkscan.nviso.be/](https://apkscan.nviso.be/)]([https://apkscan.nviso.be/](https://apkscan.nviso.be/)), accessed on 1 September 2021) is Nviso APK Scan, which statically and dynamically scans Android applications for malware. Unfortunately, the original sandbox, which acts as a base to perform the dynamic analysis, no longer supports the recent development of Android applications, resulting in missing some critical parts during the dynamic analysis [30]. An additional online automated malware analysis tool is HybridAnalysis.com ([[https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/)]([https://www.hybrid-analysis.com/](https://www.hybrid-analysis.com/)), accessed on 5 September 2021). Even though the tool was marketed as performing dynamic analysis on malware, this is only true for platforms other than Android OS [31]. On the other hand, some dynamic analysis tools are no longer supported. For example, the development and maintenance for CobraDroid, a customized Android architecture malware detection tool, have not been supported since 2015 [32]. [PERSON] et al. in [33] proposed \"Crowdroid\", a framework to check the application behavior to detect malware in the Android application. However, the tool is not available online. The authors in [34] introduced AndroTotal, which is a community tool that provides a malware repository that automatically scans Android apps against a random set of malware detectors. However, upon checking the tool, it is no longer available. Other dynamic tools have a certain limitation on the Android version, such as CuckooDroid, which only supports Android 4.1 and is based on Cuckoo 1.2 [35]. The Cuckoo sandbox was further utilized by the Sandbox Pikker tool, which provides a free automated malware analysis [36]. Another example of incompatibility issues raised by dynamic tools is TaintDroid [37]. The authors of [37] analyzed network traffic to examine the abnormal behavior of Android applications. However, the tool has not been supported since 2013. Mobile Security Framework (MobSF) is an automated application designed to conduct pen testing and security assessment, perform static/dynamic malware analysis for mobile apps (APK, IPA, and APPX), and also test REST APIs for the most common mobile platforms: Android, iOS, and Windows [38]. The framework was built as a web service with a GUI that includes a dashboard to display the analysis results. An emulator and an API that automates the process of analysis are combined in the tool. The analysis method involves decompiling the mobile application's source code, then running the mobile application dynamically. This framework utilizes unique features upon performing the analysis and vulnerability test, such as mobile app component detection and configuration detection, such as activities, services, etc. For Android OS, it performs Manifest file analysis, decompilation of the source code, permission analysis, and classification. Subsequently, the dynamic analysis is performed after the static analysis by deploying an emulator integrated into the tool, providing an interactive testing environment. The dynamic analyzer must be installed on the host device and not a virtual machine.