## 3 The Methodology
### The Improved Generative Adversarial Network Model for Ransomware Early Detection
#### 3.1.1 Phase 1: The Enhanced Bi-Gradual Minimax Function of the Generative Adversarial Network  
The purpose of GAN is to generate artificial pre-encryption attack patterns based on a dataset of real ransomware attacks. This will help in compensating for data insufficiency inherited in the data captured during the pre-encryption phase of ransomware attacks by augmenting the dataset with fake, yet realistic, samples. When a sample is fed into the discriminator, it processes the information through its layers to make a prediction regarding the authenticity of the sample. Specifically, the discriminator assigns a probability score indicating how likely it believes the sample to be real rather than synthetic. During the training process, the generator continually improves its ability to create convincing synthetic data, while the discriminator fine-tunes its ability to distinguish between real and synthetic samples. This adversarial relationship between the two networks ensures that, over time, the generator becomes proficient at producing synthetic samples that are increasingly difficult to distinguish from real data, thus challenging the discriminator to continually improve its own performance. Figure 2 shows the GAN architecture consisting of two components, the generator and the discriminator, that are trained together. The generator is responsible for creating artificial ransomware instances that resemble the real attacks. The new (artificial) ransomware instances are then sent to the discriminator that, in turns, tries to identify whether it is artificial. In this context, the generator tries to fool the discriminator by making the artificial sample as similar as the real ones as possible. Concretely, the generator creates the patterns with probability distribution similar to the probability distribution of the real ransomware. Figure 2: The general architecture of GAN. The discriminator, on the other hand, is optimized to distinguish the real and artificial attack. If successfully identified, the feedback is sent to the generator, which will readjust its weights, that helps in creating new instances closer to the real ones. This process continues iteratively until both generator and discriminator are optimized. The process starts by feeding the generator with random input from an input vector. Based on this input the generator crafts an artificial attack pattern, which will then be sent to the discriminator. The discriminator will make the decision as to whether the data is ransomware or not. If the decision is correct, the generator is updated to improve its ability to generate more accurate attack patterns. Likewise, if the decision is wrong, the discriminator is updated to improve its ability to detect the artificial attack patterns. The process continues until both generator and discriminator are optimized as shown in the equation (4). At the end of this phase, a dataset that contains both real and artificial ransomware pre-encryption attacks instances are created. This dataset is used to train the ransomware early detection module in the second phase. The Enhanced Bi-Gradual Minimax Loss Function  
In the loss function schemes used by the generator and discriminator in the GAN algorithm, the distance between the probability distributions of real and artificial patterns are measured. Our proposed Bi-Gradual Minimax loss function improves the original Minimax function mentioned in Equation (1). Although the loss functions used by the generator and the discriminator rely on different probability distributions for error calculation, they are derived from the same formula as Equation (4).