## 4 Materials and Methods
### Structure of the Ransomware Multi-Tier Streaming Analytics Model  
Figure 3 illustrates the structure of the proposed ransomware streaming analytics model. It consists of a trait extraction tier, an ancestor-family attribution tier, a multi-descent fusion tier, and a learning tier. The extraction tier works on the semi-realistic environment to analyze datasets (i.e., versions of ransomware, malware, and good-ware) into class-labeled trait space (i.e., a set of trait vectors with their class label). The semi-realistic environment is a virtual testbed used to create trap files (s) with realistic conditions, and it disseminates them into particular system directories. Once the trap (s) are exploited by ransomware, that ransomware runs its malfunctions and downloads its _crypto_-or _locker_-gadgets to either encrypt system data or halt the system. Correspondingly, the extracted trait vectors are attributed to their ancestor ransomware/non-ransomware families in the family attribution tier by normalizing the header data of each trait vector with respect to its family. Given that they assigned to their family attributes, all trait vectors are examined versus the case of a multi-descent family in the multi-descent fusion tier. ```
Definition of Semantic Codes \(S\) the stream of ransomware and non-ransomware versions such that \(S=\{S_{m}\}_{m\in[S]}\)\(T\) the compact set of traits \(T_{space}\) the generated space of extracted traits where \(T_{space}=\{T_{i}\}_{i\in[T]}\) \(T_{i}\) a trait vector included in \(T_{space}\) \(TreeNode\) the decision tree of \(T_{space}\) \(T_{sub}\) the splitting space of \(T_{space}\) such that \(T_{space}=\{T_{sub}\}_{sub\in[sub]}\) \(C_{m}\) the class model of \(T_{i}\), where \(C=[C_{m}]_{m\in M}\), and \(M\) is the number of predictive classes \(R\) the ransomware trait vectors (i.e., ransomware versions) \(R^{-}\) are the non-ransomware trait vectors (i.e., non-ransomware versions) \(F\) the trace file \(AR_{t_{i}}\) the Attribution Rate of a trait vector \(MDR(T_{i})\) the multi-descent ratio of a trait vector Input:\(S\) and \(T\) Output:\(R\) and \(R^{\prime}\) Begin
1. Generate \(T_{space}\) from \(S\) with headers
2. Repeat (3) to (c) 1. Create \(TreeNode\) 2. IF (all \(\{T_{i}\}_{i\in[T]}\) in \(T_{space}\) have similar class \(C_{m}\)) THEN \(TreeNode\gets LeafNode\) 3. Until \(T=[]\) THEN attach \(TreeNode\) to the majority class model \(C_{m}\)
4. For each \(T_{i}\) in \(T_{space}\) 1. find prior probability \(C_{j}\) over \(T_{space}\) by Equation (4) 2. Find the conditional probability of \(t_{i}\), \(t_{j}\) about \(C_{j}\) over \(T_{space}\) by Equation (5) 3. Update \(T_{i}\) in \(T_{space}\) with the maximal \(P\big{(}t_{i},j\big{|}C_{m}\big{)}\) such that \(P\big{(}C_{jm}\big{|}t_{i},j\big{)}\); \(C_{m}\to P_{ml}\big{(}C_{m}\big{|}t_{i},j\big{)}\) 4. Partition \(T_{space}\) into \(T_{space}=\{T_{sub}\}_{sub\in[T]}\) and \(T_{space}\leftarrow\{T_{sub}\}_{sub\in[T]}\)
5. Repeat (6) Until (\(T_{space}\
eq[i]\))
6. Keep all computed probabilities in \(R\) and \(R^{-}\) for classification decision 1. For each \(T_{i}\) in \(R\) and \(R^{-}\)
7. find \(AR_{t_{i}}\) 2. find \(MDR(T_{i})\) 3. keep \(AR_{t_{i}}\) and \(MDR(T_{i})\) in the trace file \(F_{i}\)
```  
**Algorithm 1**  
Figure 3: Structure of multi-tier ransomware streaming analytics model. The diagnoses of ancestor family and multi-descent families that are pursued by family attribution and multi-descent fusion tiers are implemented synchronously along with learning done by the hybrid machine learner in the learning tier. So far, the proposed ransomware streaming analytics model carries out the aforesaid multi-tiers in a multi-disciplinary manner across data, trait space, header data, and predictive classes during both the training and testing tasks, as shown in Figure 3. Thus, the input (unknown) ransomware version is analyzed on its runtime during the testing task of the proposed multi-tiered streaming analytics architecture as the same as the data of the training corpus but in a different order.