# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 1
#### 4.2.1 GANs Generative Adversarial NWs  
The GAN generates artificial pre-encryption attack patterns from real ransomware data. This addresses data insufficiency in the pre-encryption phase by adding realistic, fictional samples to the dataset. The discriminator network evaluates input samples by propagating them through its constituent layers, thereby computing a probabilistic score that quantifies the likelihood of a given sample's provenance--specifically, its authenticity versus its synthetic origin. Throughout the iterative training process, the generator network refines its capacity to synthesize increasingly realistic data, while the discriminator concurrently enhances its ability to discriminate between authentic and synthetic exemplars. This adversarial dynamic compels the generator to produce synthetic samples of progressively heightened fidelity, which, in turn, drives the discriminator towards improved discriminative performance. Figure 3 illustrates the fundamental GAN architecture, comprising a generator and a discriminator engaged in an adversarial relationship. The generator synthesizes synthetic ransomware instances, emulating real attack patterns to create realistic training data. These instances are presented to the discriminator, which endeavors to classify them as authentic or artificial. The generator aims to deceive the discriminator by producing synthetic samples whose probability distribution increasingly approximates that of authentic ransomware. Conversely, the discriminator is optimized to accurately distinguish between authentic and synthetic attacks. Successful discrimination provides feedback to the generator, prompting parameter readjustment to generate synthetic instances that more closely resemble authentic ones. This iterative process drives both networks towards a Nash equilibrium (Equations (6)-(8)). Upon completion of this adversarial training, the resulting balanced dataset of authentic and high-fidelity synthetic pre-encryption ransomware samples forms the basis for training the subsequent early detection module. Refined Minimax Loss: The Enhanced Bi-Gradual Approach  
GANs rely on loss functions to measure the difference between the probability distributions of real and generated data. To improve upon the standard Minimax loss (Equation (6)), we propose the Bi-Gradual Minimax loss function. While the generator and discriminator use separate probability distributions for their respective loss calculations, both derive their final loss value from the unified formula presented in Equation (9). \[V(\mathcal{G},\mathcal{D})=E_{x}[\partial log\ (D(x))]+E_{z}[(1-\partial) log\ (1-D(G(z)))] \tag{9}\]  
Figure 3: Schematic of the essential Generative Adversarial Network (GAN) architecture. In a GAN, the discriminator, denoted as \(D(x)\), estimates the probability that a real data instance \(x\) is authentic. The generator, \(G(z)\), produces synthetic data from a noise vector \(z\). Consequently, \(D(G(z))\) represents the discriminator's assessment of the probability that a generated instance is real. The expected values \(Ex\) and \(Ez\) are taken over real data instances \(x\) and noise vectors \(z\) (or, equivalently, generated instances \(G(z)\)), respectively. To refine the probability estimation, particularly when training a GAN-based early detection model with pre-encryption data, we introduce a gradual up-weighting coefficient, represented by \(\partial\). This coefficient modulates the discriminator's and generator's estimations, and its calculation is detailed in Equation (10). \[\partial=\frac{1+a}{R} \tag{10}\]  
The gradual coefficient, \(\partial\), is defined as the ratio \(a/R\), where \(R\) represents the fixed number of real data instances and \(a\) represents the growing number of synthetic instances. Therefore, \(\partial\) is directly proportional to \(a\). In the early stages of training, when \(a\) is small, \(\partial\) is also small because \(R\) is much larger than \(a\).