# Early Ransomware Detection with Deep Learning Models
## 7 Limitations and Future Research Directions  
The findings of this paper open several directions for future research, namely (1) the expansion of the dataset to capture a broader spectrum of real user activities and (2) the exploration of real-time detection systems integrated into network infrastructures. The PARSEC dataset, while robust, primarily includes API call sequences from simulated benign and ransomware processes. There is a compelling need to develop a dataset that will include activities from diverse computing environments such as office tasks, multimedia processing, software development, and gaming. Current ransomware detection models largely operate by analyzing static datasets. However, integrating these models into live network systems could facilitate the detection of ransomware as it attempts to execute. This approach would enable a more dynamic and proactive response to ransomware threats. The limitations of our approach are the challenges associated with using API call features and neural models for ransomware detection. Collecting and labeling a comprehensive dataset of API call sequences from benign and ransomware processes is complex, time-consuming, and resource-intensive. Maintaining dataset quality and relevance as ransomware evolves requires substantial effort and depends on the chosen processes. Neural models, particularly deep learning ones, risk overfitting specific patterns in the training data. This can result in recognizing only known ransomware sequences, rather than general malicious behavior, necessitating extensive and resource-heavy testing to ensure good \begin{table}
\begin{tabular}{l l l l l l l} \hline \hline  & & & & & & & \\ \hline model & FLIST & benign–RW ratio & acc & sensitivity & specificity & F1 \\ \hline LSTM 1-hot W=7 eps=10 & Ops & 99/1 & 0.9872 & 1.0000 & 0.9870 & 0.6073 \\ LSTM 1-hot W=7 eps=11 & Ops & 95/5 & 0.9875 & 1.0000 & 0.9868 & 0.8889 \\ LSTM 1-hot W=7 eps=12 & Ops & 90/10 & 0.9880 & 0.9989 & 0.9868 & 0.9435 \\ LSTM 1-hot W=7 eps=13 & Ops & 80/20 & 0.9898 & 1.0000 & 0.9872 & 0.9750 \\ LSTM 1-hot W=7 eps=14 & Ops & 70/30 & 0.9909 & 0.9993 & 0.9874 & 0.9851 \\ LSTM 1-hot W=7 eps=15 & Ops & 60/40 & 0.9927 & 1.0000 & 0.9878 & 0.9909 \\ \hline \hline \end{tabular}
\end{table} 
Table 13: _Cont._generalization. We also observed that the selection of processes for the training set had an effect on the performance of the model when shorter API call sequences were used as training data. This means that future applications should be mindful of this phenomenon. Conceptualization, M.K., M.D. and N.V.; methodology, M.K., M.D. and N.V.; software, M.D. ; validation, M.D. ; formal analysis, M.K., M.D. and N.V.; resources, M.K. and M.D. ; data curation, M.D. ; writing--original draft preparation, M.K. and N.V.; writing--review and editing, M.K., M.D. and N.V.; supervision, M.K. and N.V. All authors have read and agreed to the published version of the manuscript. This research received no external funding. The PARSEC dataset and the code reside in a public repository on GitHub. It is freely available to the community at [[https://github.com/[PERSON]/MSc--Ransomware-Detection-Using-Deep-Learning-Models](https://github.com/[PERSON]/MSc--Ransomware-Detection-Using-Deep-Learning-Models)]([https://github.com/[PERSON]/MSc--Ransomware-Detection-Using-Deep-Learning-Models](https://github.com/[PERSON]/MSc--Ransomware-Detection-Using-Deep-Learning-Models)). The authors declare no conflicts of interest. The following abbreviations are used in this manuscript: