# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 1
#### 4.2.2 Early Detection with Feature Selection  
In Phase 1, the augmented dataset is used to train an LSTM-based ransomware detection model. Feature selection is performed using mutual information feature selection (MIFS), to select the most informative features, as defined in Equation (11).  
\[J(X_{k})=I(X_{k};Y)-\beta\sum_{X_{j}\in S}I\big{(}X_{j};X_{k}\big{)}+\gamma \sum_{X_{j}\in S}I\big{(}X_{j};X_{k}\big{|}Y\big{)} \tag{11}\]  
In this equation, \(I(X_{k};Y)\) represents the mutual information between the candidate feature \(X_{k}\) and the class label \(Y\), and \(I(X_{j};X_{k}|Y)\) denotes the conditional mutual information between \(X_{k}\) and selected features \(X_{j}\) (from set \(S\)), given the class label \(Y\). The coefficients \(\beta\) and \(\gamma\) range from 0 to 1. By reducing data dimensionality through salient feature selection, MIFS helps prevent overfitting, enhances detection accuracy, minimizes false positives, and simplifies model complexity, making it suitable for real-time applications like early ransomware detection. The algorithm ranks features by entropy, selecting the top \(n\) features for input into the LSTM network.  
The LSTM network was chosen for the detection module due to its inherent capacity to capture temporal dependencies, a crucial attribute for early ransomware detection. The LSTM's cell state, with its memory mechanism for recalling past information, facilitates tracking polymorphic ransomware behavior during the pre-encryption phase, enabling effective monitoring. The LSTM network incorporates three gate types: input (Equation (12)), forget (Equation (13)), and output (Equation (14)):  
\[i_{t}=\sigma(\omega_{i}[h_{t-1},x_{t}+b_{i}]), \tag{12}\]  
\[i_{f}=\sigma\Big{(}\omega_{f}\Big{[}h_{t-1},x_{t}+b_{f}\Big{]}\Big{)}, \tag{13}\]  
\[i_{o}=\sigma(\omega_{o}[h_{t-1},x_{t}+b_{o}]) \tag{14}\]  
The variables \(i_{t},\ i_{f},\ and\ i_{o}\) denote the input, forget, and output gates, respectively. During training, the LSTM network utilizes the selected features and data for model optimization. The model comprises input, hidden, and output layers. The number of input layer nodes corresponds to the number of features selected by MIFS. These nodes transmit data to the hidden layers by multiplying it with the input weights. The hidden layers, whose number and nodes are optimized during training via bias adjustments, process data using activation functions. The Rectified Linear Unit (ReLU) function, as defined in Equation (15), serves as the activation function for all hidden layer nodes, except for those in the layer preceding the output, where the sigmoid function from Equation (16) is employed. The output layer receives input from the final hidden layer's sigmoid activations and classifies instances as malicious or benign based on a threshold. Instances with activation values exceeding 0.5 are classified as malicious; however, this threshold is adjustable.  
\[R(x)=max(0,x) \tag{15}\]  
\[\emptyset(x)=\frac{1}{1+e^{-x}} \tag{16}\]  
The LSTM model employs 10-fold cross-validation, partitioning the dataset into 90% training data and 10% testing data. The training data is used to construct the model, while the testing data is used to evaluate its performance. This process is iterated 10 times, with the accuracy recorded for each iteration. The average accuracy across all iterations is then calculated to determine the model's overall performance.