# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 3
#### 4.4.3 Overall Results and Discussion  
Figure 16 presents a comparative analysis of accuracy across varying input layer sizes, highlighting the superior performance of the UA-DES-DBN model compared to VGG16-PSO [90], DBN-IDS [91], and DBN [92]. Notably, UA-DES-DBN demonstrates a significant improvement in accuracy as the input size increases from 5 to 20, peaking at 0.986. While a slight decline is observed at larger input sizes, the model maintains robust performance. In contrast, CNN-MD exhibits lower accuracy rates, and DBN-IDS and DBN models show greater variability. At an input size of 25, UA-DES-DBN achieves 0.982, consistently outperforming the other models. These results underscore the effectiveness of the UA-DES-DBN model, particularly in mid-range input sizes. The model's ability to maintain high accuracy, even with slight fluctuations, demonstrates its resilience and adaptability to complex data patterns. The integration of uncertainty estimation and dynamic stopping criteria effectively mitigates overfitting, contributing to the model's robust performance. This validation confirms the UA-DES-DBN model's potential for reliable and accurate ransomware detection in real-world scenarios. Despite the strong performance of UA-DES-DBN, the difference from other models is sometimes narrow. Advanced ransomware evasion techniques like polymorphic and metamorphic behaviors cover malicious intent that make early detection harder. The model focuses on the pre-encryption phase, where attack patterns are scarce and less distinct. Even slight accuracy improvements in this stage are significant because they enhance the proactive mitigation of ransomware attacks before encryption occurs. The ability to identify small anomalies early provides an advantage in cybersecurity defense. \begin{table}
\begin{tabular}{c c} \hline \hline
**Type** & **Features** \\ \hline Crypto APIs & CryptEncrypt\(\,|\,\)CryptGenKey\(\,|\,\)CryptDestroyKey\(\,|\,\)CryptGenRandom \\ \hline File Access APIs & CreateFile\(\,|\,\)FindFirstFileEXA\(\,|\,\)FindNextFileA\(\,|\,\)DeleteFile \\ \hline Network APIs & WinHttpConnect\(\,|\,\)WinHttpOpenRequest \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Sample of API call features fed into the UA-DES-DBN model [70]. Figure 16: Accuracy comparison: UA-DES-DBN vs. existing methodologies [70]. As Figure 17 shows, UA-DES-DBN exhibits lower false positive rates (FPRs) than CNN-MD, DBN-IDS, and standard DBN models across varying input layer sizes (20-50). Notably, at an input size of 25, UA-DES-DBN achieves an FPR of 0.104, demonstrating superior performance in complex data processing. This reduction in FPR, particularly at larger input sizes, is attributed to UA-DES's dynamic training adjustments based on uncertainty, effectively preventing overfitting and refining decision thresholds. Figure 18 illustrates UA-DES-DBN's consistently high DR across various input sizes, which often surpasses or closely matches other models. At an input size of 25, it achieves a DR of 0.956, emphasizing its ability to accurately identify ransomware. The UA-DES mechanism enhances detection by adjusting training based on uncertainty. This ensures a perfect balance between underfitting and overfitting. Moreover, its ability to leverage larger input sizes for improved detection is particularly useful for evolving ransomware threats. The F-score comparison in Figure 19 further validates UA-DES-DBN's effectiveness in balancing precision and recall for ransomware detection. At an input size of 30, it achieves an F-score of 0.962 that outperforms other models. The UA-DES mechanism's dynamic training adjustments prevent overfitting and improve generalization. So, it ensures consistently high F-scores across different input sizes. These findings prove the  
Figure 17: FPR comparison: UA-DES-DBN vs. existing methodologies [70]. Figure 18: DR comparison: UA-DES-DBN vs. existing methodologies [70]. importance of advanced early stopping mechanisms in developing robust and precise cybersecurity models.