## 5 Experiments and Results
### Data Collection and Evaluation Metrics  
By searching publically used archives like the Virus Total Intelligence Platform and Virus Share, the executable and portable ransomware and malware versions are aggregated to construct data corpora. Exclusively, our data aggregation targets those versions that are submitted at least three times to the aforesaid data archives between 1 January 2019 and 1 September 2019, and they are still undetected by any existing antivirus software and/or anti-ransomware tools. Similarly, the good-ware instances are aggregated and merged randomly to the aforesaid data corpora based on particular heuristics of benign software apps. As described in Table 5, the aggregated data corpora are divided randomly into \(\frac{2}{3}^{nd}\) and \(\frac{1}{3}^{nd}\) as training data corpus and testing data corpus to be used in training and testing tasks, respectively. On the other hand, the rates of true positive (TPR), false positive (FPR), false negative (FNR), and classification accuracy as well as mistake rate, miss rate, and elapsed time; all are used as standard performance evaluation metrics for the evaluation task in recently published works [11; 27; 28; 29; 34; 35]. TPR, FPR, and FNR are derived from the confusion matrix calculations as follows:  
\[TPR=\frac{TP}{TP+FN} \tag{6}\]  
\[FPR=\frac{FP}{TN+FP} \tag{7}\]  
\[FNR=\frac{FN}{TP+FN} \tag{8}\]  
where TPR refers to the rate of correctly classified ransomware data, FPR indicates the rate of wrongly classified good-ware data as ransomware, and FNR indicates the rate of wrongly labeled ransomware data as good-ware data, respectively. While TP is the number of good-ware samples classified as ransomware, FN is the number of ransomware samples classified as good-ware, TN is the number of ransomware samples that correctly classified, and FP is the number of good-ware samples that classified as ransomware; respectively. Based on the above mentioned standard metrics, the classification accuracy rate (ACCR) is calculated to validate the effectiveness of the applied machine learner and/or anti-ransomware tool at detecting valid ransomware (TP) and valid good-ware samples (TN) relatively to the whole data corpora as follows:  
\[ACCR=\frac{TP+TN}{TP+FP+TN+FN} \tag{9}\]  
Figure 5: The run-time test routine of the multi-tier streaming analytics model. Accordingly, mistake rate is computed to qualify the abilities of the comparable anti-ransomware tools as well as the proposed ransomware multi-tier streaming analytics model on how they rationally detect the valid ransomware versions with least false classifications as per Equation (10); whereas, the miss rate is computed to qualify their abilities to rationally detect valid ransomware versions with least misclassification cost as per Equation (11). \[\text{Mistake Rate}=\frac{\text{FP}}{\text{N}_{\text{G}}} \tag{10}\]  
\[\text{Miss Rate}=\frac{\text{FN}}{\text{N}_{\text{R}}} \tag{11}\]  
where, N\({}_{\text{G}}\) and N\({}_{\text{R}}\) are the number of good-ware data and ransomware data, respectively. In addition, the Elapsed Time plays an important to assert how long the comparable machine learners and anti-ransomware tools spend to execute and respond by examining a batch of data with a nominal cost of computations [35; 36; 37]. On the other hand, the proposed HML is assessed against its competitor machine learners in terms of AUC against the up-to-date ransomware, malware, and good-ware data during the real test. AUC calculation is widely used to justify the performance of a machine learning algorithm on experimental data by devoting the scalar value of the receiver operating characteristic curve (ROC), which is a plot of TPR versus FPR [35; 37; 38]. If the AUC score closes to 0.9, then it signifies an excellent performance in the realistic practice; while score values of 0.8, 0.7, and less could signify good, moderate, and then poor performance [38; 39].