# Hybrid-Based Analysis Impact on Ransomware Detection for Android Systems
## 5 Results and Discussion
### Detection Accuracy  
In order to analyze how the experiment proceeded, we used the information recorded from the static analysis to calculate the detection accuracy of all the ransomware samples generated from VirusTotal. The static analysis falls back to almost half of the accuracy detection--ranging around 40-55%. That means, on average, half of the antivirus engines managed to detect malware samples successfully. Figure 4 illustrates the detection accuracy of the 100 ransomware apps. The results are presented for each sample during the static analysis; it can be noticed that sample 58 achieved the highest accuracy of detection with 64.91%, whereas sample 19 achieved the lowest accuracy with 36.67%. Overall, most of the VirusTotal detection and analysis engine performances were below the average, which is 50.28%. The detection accuracy of all ransomware apps are summarized in Table 4.  
On the other hand, to answer our research question on the impact of the dynamic analysis in detecting ransomware, Figure 5 shows the results of the detection accuracy of the 22 samples provided from VirusTotal and MobSF. The figure shows that whenever the dynamic analysis is performed on a ransomware sample, it always performs its task. For example, this task could be locking the screen and changing the password along with the wallpaper or encrypting the files stored on the mobile phone. This probability consistently achieved a detection accuracy of 100%. In contrast, most samples had less than 50% as an average detection rate when they were statically analyzed using VirusTotal. As a result, using the dynamic analysis has a higher detection accuracy and provides better performance in discriminating ransomware apps.  
Figure 4: Static detection accuracy in VirusTotal for 100 ransomware samples.  
Figure 5: Detection accuracy comparison between static and dynamic analysis for VirusTotal and MobSF.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \multirow{2}{*}{**ID**} & **Total** & **Detected** & **Undetected** & **Accuracy** & **ID** & **Total** & **Detected** & **Undetected** & **Accuracy** \\  & **Engines** & **Engines** & **Engines** & **Energy** & **Engines** & **Engines** & **Engines** & **Accuracy** \\ \hline
**1** & 61 & 31 & 30 & 50.82\% & **51** & 63 & 29 & 23 & 46.03\% \\ \hline
**2** & 59 & 26 & 21 & 44.07\% & **52** & 63 & 30 & 22 & 47.62\% \\ \hline
**3** & 56 & 26 & 18 & 46.43\% & **53** & 62 & 34 & 22 & 54.84\% \\ \hline
**4** & 62 & 32 & 24 & 51.61\% & **54** & 61 & 32 & 24 & 52.46\% \\ \hline
**5** & 61 & 27 & 22 & 44.26\% & **55** & 59 & 33 & 21 & 55.93\% \\ \hline
**6** & 61 & 32 & 24 & 52.46\% & **56** & 63 & 27 & 24 & 42.86\% \\ \hline
**7** & 60 & 29 & 26 & 48.33\% & **57** & 61 & 28 & 22 & 45.90\% \\ \hline
**8** & 56 & 30 & 21 & 53.57\% & **58** & 57 & 37 & 15 & 64.91\% \\ \hline
**9** & 61 & 35 & 20 & 57.38\% & **59** & 63 & 30 & 22 & 47.62\% \\ \hline
**10** & 61 & 31 & 21 & 50.82\% & **60** & 61 & 29 & 21 & 47.54\% \\ \hline
**11** & 57 & 27 & 25 & 47.37\% & **61** & 58 & 31 & 15 & 53.45\% \\ \hline
**12** & 63 & 31 & 23 & 49.21\% & **62** & 61 & 32 & 17 & 52.46\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Summary of ransomware apps used in the experiments and their detection accuracy.  
\begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline \multirow{2}{*}{**ID**} & \multicolumn{2}{c}{**Total**} & \multirow{2}{*}{**Detected**} & \multirow{2}{*}{**Detected**} & \multirow{2}{*}{**Accuracy**} & \multirow{2}{*}{**ID**} & \multicolumn{2}{c}{**Total**} & \multirow{2}{*}{**Engines**} & \multirow{2}{*}{**Detected**} & \multirow{2}{*}{**Engines**} & \multirow{2}{*}{**Accuracy**} \\  & \multicolumn{2}{c}{**Engines**} & & & & & & & & & \\ \hline  
\hline \end{tabular}
\end{table}
Table 4: _Cont._