# Early Ransomware Detection with Deep Learning Models
## 3 PARSEC Dataset
### Data Analysis  
We performed a visual and numeric analysis of our datasets to assess the quality and behavior of benign and ransomware processes. We focused on two datasets--PARSEC-500 and PARSEC-5000--that represent the smallest and biggest numbers of initial API calls taken from each process.  
Table 1 contains the number of API calls performed by benign and ransomware processes for the PARSEC-500 and PARSEC-5000 datasets. We omitted the calls that were never performed through ransomware processes from this table (the full list of these calls is provided in Appendix A.3 of Appendix A). We can see, surprisingly, that the same calls appear when the first 500 API calls are taken (PARSEC-500) or the first 5000 (PARSEC-5000). It is also evident, in total, ransomware processes perform much more CloseFile, CreateFile, and IRP_MJ_CLOSE than benign processes do. They, however, perform fewer ReadFile operations than benign processes, regardless of the number of system calls recorded.  
Next, we performed a visual analysis to reveal distinguishing malware characteristics. For each process, we generated a square image where each pixel represents an API call, color-coded according to the operation performed. The images were plotted with legends, associating each color with its respective API call operation. The visual analysis revealed a stark contrast between benign and ransomware processes. Benign processes exhibited a diverse array of patterns, reflecting the wide-ranging legitimate functionalities and interactions  
\begin{table}
\begin{tabular}{l r r r r} \hline \hline \multirow{2}{*}{**Operation**} & \multicolumn{2}{c}{**PARSEC-500**} & \multicolumn{2}{c}{**PARSEC-5000**} \\  & **Benign** & **Ransomware** & **Benign** & **Ransomware** \\ \hline CloseFile & 1168 & 5052 & 9151 & 22323 \\ CreateFile & 1921 & 5061 & 11044 & 23374 \\ IRP\_MJ\_CLOSE & 915 & 3717 & 6975 & 17031 \\ Process Profiling & 6402 & 228 & 8996 & 388 \\ QueryAttributeTagFile & 514 & 1269 & 1189 & 4645 \\ QueryBasicInformationFile & 327 & 3306 & 2210 & 15182 \\ QueryDirectory & 153 & 601 & 1916 & 4546 \\ QueryOpen & 388 & 1075 & 3636 & 6987 \\ QueryStandardInformationFile & 678 & 1230 & 2443 & 4635 \\ ReadFile & 1618 & 2888 & 19005 & 10593 \\ SetBasicInformationFile & 780 & 1123 & 1496 & 4992 \\ SetRenamelInformationFile & 0 & 1259 & 3 & 4643 \\ WriteFile & 216 & 2606 & 5251 & 9986 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Number of system calls comparison  
Figure 3: Data representation pipeline.  
within the system. Each benign process presents a unique color distribution, illustrating the variability and complexity of non-malicious software operations. An example is shown in Figure 4. Visualization of other benign processes appears in Appendix A.4 of Appendix A.  
In contrast, ransomware processes displayed a more homogenous appearance, with similar color distributions among them. This uniformity suggests a narrower set of operations being executed, which could be indicative of the focused, malicious intent of these processes. Remarkably, the ransomware processes can be grouped into a few distinct types based on the visualization of their operational sequences, suggesting the existence of common strategies employed across different malware samples.  
The first type of malware (Figure 5) prominently features operations like QueryBasicInformationFile, ReadFile, and CreateFile in repetitive patterns.  
The second type of malware (Figure 6) exhibits a more randomized and chaotic distribution of API calls across the images.  
Finally, the third type of malware (Figure 7) displays a distinct two-part division, possibly indicating a shift from the initial setup or reconnaissance to intense malicious activity, such as data manipulation or encryption.  
In total, we observed patterns unique to malicious activities visually, which implies that sequence analysis is useful for malware detection.