# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 3
#### 4.4.1 UA-DES: Mathematical Steps and Algorithm
Calibration for Reliable Probability Estimates**  
After obtaining the raw model output probabilities \(p\), apply a calibration function \(f\) to adjust these probabilities:  
\[calibrated=f(p) \tag{23}\]  
Temperature Scaling (TS) is a post-processing calibration technique that refines Soft-Max outputs to better reflect true probabilities, without altering the model's architecture or prediction order. By adjusting output probabilities, TS improves the model's ability to distinguish threats, reducing false alarms. Calibrating the temperature parameter on a validation set aligns predictions with actual results, enhancing generalization and reliability, thus ensuring UA-DES-DBN's effectiveness and maintaining predictive performance despite early stopping. The TS calibration function operates as follows. Let \(z\) represent the logits, which are the raw outputs from the DBN model before applying the SoftMax activation. In other words, logits are the values produced by the neural network before conversion into probabilities. The standard SoftMax function, which transforms these logits into probabilities, is defined as  
\[P(y=i|x)=\frac{e^{z_{i}}}{\sum_{j}e^{z_{j}}} \tag{24}\]  
where \(y\) is the predicted class, \(x\) is the input, \(z_{i}\) is the logit for class \(i\) and the denominator sums over all possible classes. Temperature Scaling introduces a temperature parameter \(T\) to modify the SoftMax function. The adjusted SoftMax function becomes  
\[P_{T}(y=i|x)=\frac{e^{z_{i}/T}}{\sum_{j}e^{z_{j}/T}} \tag{25}\]  
Here, \(T\) is a scalar that adjusts the \"sharpness\" of the probability distribution. A higher \(T\) makes the distribution softer (more uniform), while a lower \(T\) makes it sharper. Calibration seeks to adjust the model's predictive probabilities to match the true likelihood of outcomes by finding the optimal temperature. This process involves minimizing a loss function, with the Negative Log-Likelihood (NLL) being the commonly used metric, on a validation dataset:  
\[NLL=\sum_{(x,y)\
i Validation\ Set}\log\ P_{T}(y|x) \tag{26}\]  
The objective is to find  
\[T^{*}=\text{arg min}\ \!NLL(T) \tag{27}\]  
where \(T^{*}\) is the temperature that minimizes the \(NLL\) over the validation data. Once \(T^{*}\) is determined, the model's final output probabilities are adjusted using this optimal temperature:  
\[P_{T^{*}}(y=i|x)=\frac{e^{z_{i}/T^{*}}}{\sum_{j}e^{z_{j}/T^{*}}} \tag{28}\]  
This calibrated probability distribution is applied to all future predictions, helping align the model's confidence with real outcomes. This improves reliability and enhances decision-making accuracy in ransomware detection. The \"output probabilities\" in our DBN-based ransomware detection model represent the model's predicted likelihoods of a network event belonging to either the ransomware or benign class. This results in a two-element probability vector, where the probabilities sum to one. This practice of generating class probability vectors, even in binary classification, is a common and flexible design choice in machine learning, facilitating future multi-class extensions. **Step 4. Active Learning Framework**  
The selection of training samples is driven by maximizing expected information gain, a metric that quantifies the reduction in model uncertainty. Specifically, samples are chosen whose incorporation into the training set would yield the highest post-selection entropy, as evaluated by the current model state. This targeted approach prioritizes samples residing in regions of high uncertainty, thereby enabling the model to efficiently refine its predictive accuracy and robustness. By focusing on these information-rich, high-entropy samples,the model strategically addresses its knowledge gaps, leading to a more effective learning process.