# Ransomware-Resilient Self-Healing XML Documents
## 5 Performance Evaluation
Here, CPU utilization is the amount of work handled by the CPU while creating a protected version for each file. Generally, for small files, CPU utilization increases with increasing file size. However, for larger file sizes, it levels off to some decent value. By monitoring the CPU utilization for each job executed when creating a protected version, we observed that when the bzip2 compression algorithm was used the CPU utilization was evidently the highest. Figure 9a-c show how the memory usage changes against the original file size to create the snapshot in the proposed SH-VARR schema when leveraging the zip, gzip, and bzip2 compression algorithms. Figure 9d illustrates all cases together for comparison purposes. It is readily seen that the memory usage, for the cases when the zip and gzip compression algorithms are used, is almost fixed (around 6.8 KBs) where it does not show any dependence on file size. Meanwhile, memory usage for the case involving the bzip2 compression algorithm is seen to increase with increasing file size, then it remains constant (around 28 KBs) for files with large sizes. This is because all the compression algorithms (zip, gzip, and bzip2) involved in our assessment of the proposed framework do not capture the entire file into the memory. Instead, they acquire it as a stream requiring a specific amount of memory each time (i.e., takes a chunk of data of a specific size each time), and the amount needed depends on the compression method used and the file size involved. Figure 7: Time requirement for SH-VARR snapshot based on three compression algorithms. (**a**) Using zip algorithm; (**b**) Using gzip algorithm; (**c**) Using bzip2 algorithm; (**d**) All algorithms. Figure 8: CPU utilization by SH-VARR snapshot based on three compression algorithms. (**a**) Using zip algorithm; (**b**) Using gzip algorithm; (**c**) Using bzip2 algorithm; (**d**) All algorithms. Figure 9: Memory usage by SH-VARR snapshot based on three compression algorithms. (**a**) Using zip algorithm; (**b**) Using gzip algorithm; (**c**) Using bzip2 algorithm; (**d**) All algorithms. Finally, we compare the proposed mechanism with the work presented in [54; 55]. In [55], the authors presented a Ransomware protection framework that depends on a network connection to backup files on a local or a remote server. However, they did not provide any performance evaluation of their framework in terms of time and storage requirements. In [54], the authors proposed backing up critical data in a fully isolated spare space that is not reachable by Ransomware, regardless of what privilege it can obtain. The authors assumed that the computing device has a particular portion of extra space, which can be utilized to create the backup volume to store encoded files with reverse deltas. This is different than the proposed work, where we can hold both reverse deltas and complete snapshots of files. We also used compression techniques to utilize the storage better. Moreover, our proposed work is portable because it can be shipped as a plugin that can be attached to documents; a feature that is not supported by [55] or [54].