# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Threshold-Based Adjustment Function for Weighting Factor Stability
#### 4.3.3 Performance Evaluation of IMIS  
This section compares our IMIS technique against established feature selection methods like RCGU, EMRMR, MIFS, and JMI for ransomware detection [71]. We used Python 3.11.7 with libraries such as Scikit-learn, Pandas, NumPy, SKFeature, and TensorFlow, running experiments on a Windows 10 workstation. We evaluated each technique's accuracy, FPR, DR, and F1-score across various feature set sizes. Unlike static methods, IMIS dynamically updates feature relevance, giving it a key advantage as ransomware evolves. The evaluation rigorously assessed IMIS's effectiveness in dynamic ransomware detection, benchmarking its real-time feature relevance against the static nature of the  
Figure 10: Data flow and component architecture of the IMIS-DBN ransomware detection system. other techniques. Our setup allowed a direct comparison of adaptability and performance. IMIS's unique incremental approach, continuously refining feature relevance with new data, was the central focus of this investigation. As shown in Figure 11, IMIS consistently outperformed other methods across feature counts from 5 to 50. It achieved a strong initial accuracy of 0.949 with just five features, demonstrating its quick analytical capability. IMIS peaked at 0.979 accuracy with 25 features, showing significant performance gains in this range. Its sustained advantage, especially over RCGU, stems from its dynamic and adaptive re-evaluation of feature importance, keeping it aligned with evolving ransomware. This adaptability, a key differentiator, validates IMIS's potential for real-time, proactive threat detection. Figure 12 compares FPR for IMIS, RCGU, EMRMR, and MIFS (5-50 features). IMIS consistently shows lower FPR, starting at 0.175 with 5 features and reaching 0.104 at 25. While IMIS and RCGU match at 30 features (0.123), IMIS remains competitive beyond, outperforming at 40 and 45 features and maintaining a lower FPR (0.150) at 50. IMIS's iterative feature reassessment ensures relevance to evolving ransomware, reducing false positives. Figure 13 illustrates the DR comparison between IMIS, RCGU, EMRMR, and MIFS. IMIS achieves a high detection rate across all feature set sizes, starting at 0.913 for 5 features and peaking at 0.942 with 25 features, outperforming all other techniques. RCGU follows closely at 0.934, but IMIS maintains a consistent lead at 15, 25, 35, and 40 features. Even at  
Figure 11: Accuracy of IMIS vs. RCGU, EMRMR, MIFS, and JMI across 5 to 50 features [72]. Figure 12: FPR of IMIS vs. RCGU, EMRMR, MIFS, and JMI across 5 to 50 features to evaluate the effectiveness in reducing false alarms [72]. 50 features, IMIS upholds a strong DR of 0.927, while other techniques see a noticeable drop in performance. This improvement comes from IMIS's ability to balance historical and new data and enhance feature selection based on evolving attack patterns. Unlike traditional MI-based methods that use static feature importance, IMIS updates feature relevance to ensure the detection model is responsive to new and existing ransomware threats. Figure 14 provides a detailed comparative analysis of the F1-score performance between IMIS and its competing methodologies across a comprehensive range of feature set sizes (5-50). The data unequivocally establishes IMIS's consistent dominance, characterized by superior F1-score values throughout the entire spectrum. Commencing with a robust F1-score of 0.935 at 5 features and culminating in a peak performance of 0.950 at 20 features, IMIS demonstrates its exceptional capacity for balanced precision and recall. While a marginal convergence in F1-scores is observed as the feature count increases, IMIS steadfastly maintains its preeminence across all feature dimensions. This sustained performance superiority underscores IMIS's adeptness at harmonizing accuracy and recall, thereby ensuring both high detection rates and minimal false positive occurrences.