## 3 The Proposed Model
### Parameter Optimization: DWO Algorithm  
In this work, the design of the DWO algorithm aids in the optimal parameter selection of the ELM model. This model mimics the behavior of the dwarf mongoose while searching for its food. Usually, DWO initiates by fixing the first value in a sequence of solutions through the subsequent Equation [21]:  
\[x_{i,j}=l_{j}+rand\times\big{(}u_{j}-l_{j}\big{)} \tag{22}\]  
In Equation (22), \(rand\) denotes an arbitrary value integrated within [0,1], while \(u_{j}\) and \(l_{j}\) indicate the limit of the search domain. The swarming of DWO comprises three groups, namely, babysitters, the alpha group, and scouts. Every group has its own means of capturing food, and this is discussed below:  
* Alpha Group  
The fitness of every solution can be calculated when the population is introduced. Equation (23) computes the probability value for the fitness of the population, and (\(\alpha\)) the alpha female is selected according to the probability  
\[\alpha=\frac{fit_{i}}{\Sigma_{i=1}^{n}fit_{i}} \tag{23}\]  
\(n\) corresponds to the mongoose counts in the alpha group. The babysitter's number is represented as bs. Peep shows the vocalization of the leading female, which keeps the family on track. Every mongoose sleeps in the initial sleeping mounds that are fixed \(\varnothing\). The DWO applies the expression for generating a candidate food location. \[X_{i+1}=X_{j}+phi\times peep \tag{24}\]  
The sleeping mound is given as follows in every reiteration, in which _phi_ indicates a uniform distribution random number \([-1,1]\). \[sm_{i}=\frac{fit_{i+1}-fit_{i}}{\max\ \{|fit_{i+1},fit_{i}|\}} \tag{25}\]  
Equation (26) encompasses the average value of the sleeping mound. \[\varphi=\frac{\Sigma_{i=1}^{n}sm_{i}}{n} \tag{26}\]  
When the babysitting exchange condition is satisfied, it progresses to the scouting stage; wherever the sleeping mound or following food source is, is taken into account. * Scouts  
Since mongooses are known to not return to earlier sleeping mounds, the scout looks for the sleeping mounds, which ensures exploration. For this method, foraging and scouting are implemented simultaneously. This motion is modeled after an unsuccessful or successful search for sleeping mounds. In other words, the movement of mongooses is dependent on the overall accuracy. In that regard, if the family forages some distance, they come to a novel sleeping mound as shown below. \[X_{i+1}=\left\{\begin{array}{l}X_{i}-CF*phi*rand*\left[X_{i}-\overset{\to}{M} \right]if\ \varphi_{i+1}>\varphi_{i}\\ \\ X_{i}+CF*phi*rand*\  
Figure 3 illustrates the set of confusion matrices formed by the DWOML-RWD model in different runs. With run-1, the DWOML-RWD model classified 412 samples into goodware and 417 samples into ransomware. At the same time, with run-2, the DWOML-RWD model classified 413 samples into goodware and 416 samples into ransomware. Simultaneously, with run-3, the DWOML-RWD model classified 415 samples into goodware and 418 samples into ransomware. Additionally, with run-4, the DWOML--RWD model classified 414 samples into goodware and 418 samples into ransomware. Lastly, with run-5, the DWOML-RWD model classified 416 samples into goodware and 419 samples into ransomware. \begin{table}
\begin{tabular}{c c} \hline \hline
**Class** & **No. of Samples** \\ \hline Goodware & 420 \\ Ransomware & 420 \\
**Total Number of Samples** & **840** \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Dataset details. Figure 3: Confusion matrices of DWOML-RWD approach: (**a**) run-1, (**b**) run-2, (**c**) run-3, (**d**) run-4, and (**e**) run-5. Table 2 displays the overall classification results of the DWOML-RWD model on ransomware detection. Figure 4 reports a brief ransomware classification performance of the DWOML-RWD model in terms of \(accu_{y}\), \(sens_{y}\), \(spec_{y}\), and \(F_{score}\). The results imply that the DWOML-RWD model ensured enhanced performance under both classes.