## 7 Discussion  
Comparisons with the results of previous work are not straightforward because the full range of metrics is often not quoted. Specifically, the raw values of True Positives, True Negatives, False Positives, and False Negatives are often omitted. As discussed earlier, these four values are the basis of all the other metrics discussed. The quoted results from relevant publications are summarised in Table 4.  
Where values were not given, the table cells have been shaded grey and labelled 'n/a'. The results quoted by [PERSON] et al. (2020) relate to their SVM model with a feature set size of 90 features, each feature being an \(n\)-gram of system calls with \(n=3\). The EmRmR algorithm was used to remove 'noise' API calls from ransomware traces. The values for Accuracy, Recall, and Precision were all good, but no figures were given for True Positive Rate, True Negative Rate, or False Negative Rate. Emphasis was placed on the False Positive Rate of 1.60%, which is arguably not the most important metric for a ransomware detection system.  
[PERSON] et al. (2020) achieved the statistics quoted above using Odds Ratio to achieve feature reduction and a Random Forest algorithm. The effectiveness of the models tested is assessed purely based on accuracy.  
[PERSON] et al. (2020) implemented a three-way algorithm which classified samples into Benign, Malware, and Ransomware categories. They proposed a Class Frequency--Non Class Frequency (CF-NCF) algorithm to generate \(n\)-grams. They achieved an accuracy of 99.05% using a random forest algorithm with \(n=3\) when distinguishing between ransomware and benign samples. However, in their comparison with other classification methods, they quote an accuracy figure of 98.65% (Table 4), which is achieved by the random forest algorithm with 1-g. The discussion of the results is again framed in terms of accuracy, so the tendency of their models towards false positives or false negatives is not discussed.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Paper** & **TPR** & **FPR** & **TNR** & **FNR** & **Accuracy** & **Precision** & **Recall** & **F1 Score** \\ \hline (RF) & 100.00\% & 8.57\% & 91.43\% & 0.00\% & 95.90\% & 92.73\% & 100.00\% & 96.23\% \\ (ANN Model 3) & 95.42\% & 1.43\% & 98.57\% & 4.58\% & 96.93\% & 98.65\% & 95.42\% & 97.01\% \\ (25) & n/a & 1.60\% & n/a & n/a & n/a & 98.60\% & 99.40\% & 98.60\% \\ (32) & n/a & n/a & n/a & n/a & 97.30\% & n/a & n/a & n/a \\ (33) & n/a & n/a & n/a & n/a & 98.65\% & 98.25\% & 98.94\% & 98.54\% \\ (26) & 98.45\% & 1.50\% & n/a & n/a & n/a & 98.50\% & 98.50\% & 98.50\% \\ (28) SVM & n/a & n/a & n/a & n/a & 98.80\% & 98.50\% & 100.00\% & 99.30\% \\ (28) MLP & n/a & n/a & n/a & n/a & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparison with results from previous work.  
[PERSON] et al. [26] quote slightly different figures for TPR and Recall. These are different names for the same metric, so the reason for this is not clear. They note that their dataset was imbalanced between ransomware and benign classes. They describe their use of SMOTE to address this imbalance and demonstrate improvements in the accuracy of their models after the application of SMOTE. Again, there is an emphasis on the true positive rate and false-positive rate, with the true and false-negative rates not discussed.  
The Support Vector Machine and Multi-Layer Perceptron results from [PERSON] et al. [28] are very encouraging, but their detailed analysis of their performance against different ransomware families shows that these algorithms were less capable of identifying CryptoLocker and CryptoWall ransomware. The detailed analysis shows accuracies of 97.6% for SVM and 98.0% for MLP. This is in contrast to the headline metrics for the MLP model, where Accuracy, Precision, Recall, and F Score all reach 100%.