# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 3
#### 4.4.1 UA-DES: Mathematical Steps and Algorithm
The information gain, \(IG(x)\) for a sample \(x\) can be defined as  
\[P(\theta\mid D)=\frac{P(D\mid\theta)P(\theta)}{P(D)} \tag{20}\]0  
where \(H\) represents entropy, a measure of uncertainty, and \(E_{p(\theta|D)}[H(\hat{y}\mid x,\theta)]\) denotes the expected entropy over the posterior distribution of the model parameters. To efficiently train our framework, particularly with large, unlabeled datasets, we employ an uncertainty sampling strategy. This approach selectively labels data samples where the model exhibits the highest prediction uncertainty, minimizing the need for exhaustive labeling. We quantify this uncertainty using an entropy-based measure, which guides the selection of the most informative samples. \[P(\theta\mid D)=\frac{P(D\mid\theta)P(\theta)}{P(D)} \tag{20}\]1  
The term \(H(y\mid x)\) represents the entropy of the predicted class probability distribution for a given data sample \(x\). This entropy is calculated based on \(P(y=i\mid x)\), which is the model's estimated probability that \(x\) belongs to class \(i\). Consequently, higher entropy values indicate that the model's prediction is less confident. **Step 5. Dynamic Stopping Criteria**  
Training termination is governed by a composite stopping criterion, incorporating an accuracy performance improvement threshold \(\Delta P\), predictive uncertainty \(\sigma^{2}_{\text{threshold}}\), and calibration quality \(C\). This multifaceted approach is designed to mitigate overfitting and enhance detection accuracy through early stopping. Given that accuracy is the primary objective, accuracy-related metrics are prioritized. Empirical evaluations have validated the efficacy of this methodology, demonstrating that our model surpasses those presented in related studies. Training ceases when  
\[P(\theta\mid D)=\frac{P(D\mid\theta)P(\theta)}{P(D)} \tag{20}\]2  
where \(\epsilon\) is a small positive value indicating the minimum acceptable performance improvement, \(\sigma^{2}_{\text{threshold}}\) is the maximum acceptable uncertainty level, and \(C_{\text{min}}\) is the minimum calibration quality threshold. The use of the AND operator in our stopping criteria is primarily intended to optimize protection against overfitting, a prominent concern in ransomware detection. This technique guarantees that the model continues training until it meets all conditions, avoiding early termination based on a single criterion, which could undermine the model's ability to generalize. This is especially important due to the nature of ransomware early detection, which should happen as early as possible before the encryption phase takes place. The mathematical formalization presented in Steps 1-5 establishes a rigorous foundation for the Uncertainty-Aware Deep Ensemble System (UA-DES) technique. This framework enables systematic early stopping in DBN training for ransomware detection by quantitatively evaluating performance, uncertainty, calibration, and information gain. Ultimately, this optimization enhances model generalization and accuracy. Algorithm 2 details the pseudocode for the UA-DES technique's integration with the DBN. The UA-DES algorithm, integrated into DBN training for ransomware detection, aims to mitigate overfitting and enhance model generalization. It initiates DBN training with predefined parameters and proceeds through epochs, employing early stopping criteria based on performance improvement, uncertainty thresholds derived from dropout simulations, and calibration quality measured by metrics like Expected Calibration Error (ECE). An active learning phase strategically selects high-value samples to optimize training efficiency. Training terminates when performance plateaus, as determined by a dynamic stopping criterion. The resulting trained DBN model is then saved for subsequent ransomware detection tasks, striving for a robust and accurate model capable of consistently identifying ransomware attacks. ```
Initialize DBN model Initialize training parameters (epochs, learning rate, etc.)