# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Threshold-Based Adjustment Function for Weighting Factor Stability
#### 4.3.1 IMS-DBN Integration  
The integration of IMIS with a DBN significantly enhances ransomware detection accuracy. DBNs are adept at learning intricate patterns from high-dimensional ransomware data. IMIS's continuous evaluation and dynamic adjustment of feature selection, based on evolving attack patterns, ensures the DBN is trained on a compact, relevant feature subset. This integration not only improves detection accuracy but also optimizes computational resource utilization. The process operates in two distinct phases: initially, IMIS selects features based on their mutual information scores relative to the target class; subsequently, IMIS dynamically updates this feature subset with new data, ensuring the DBN utilizescurrent information. This incremental approach is efficient, scalable, and particularly beneficial for resource-constrained systems.  
In the second phase, the IMIS-selected feature subset serves as input for the DBN, facilitating deep learning-based ransomware detection. The DBN's layered architecture extracts hierarchical representations, crucial for identifying complex threats. IMIS's adaptability prevents the DBN from being overwhelmed by data volume or misled by obsolete features, which is vital in rapidly evolving cyber threat landscapes. IMIS's dynamic feature selection enables the detection of both known and novel threats, fostering proactive defense against evolving malware.  
Algorithm 1 (below) presents the pseudocode for IMIS, which systematically selects and updates ransomware features for effective detection. This framework ensures IMIS efficiently adapts to new data patterns while maintaining computational efficiency, rendering it particularly effective for dynamic ransomware behavior.  
```
Data_Batches: Stream of data batches from devices Target_Class: The class variable for intrusion detection (e.g., normal or attack) Alpha: Weighting factor for balancing historical and new data (initially set) Threshold: Threshold for significant change in mutual information Output: Selected_Features: Set of features selected for intrusion detection Procedure IMIS (Data_Batches, Target_Class, Alpha, Threshold): Initialize Historical_MI as an empty dictionary Initialize Selected_Features as an empty set for each Batch in Data_Batches: Current_MI = CalculateMutualInformation(Batch, Target_Class) Historical_MI = UpdateFeatureRelevance(Historical_MI, Current_MI, Alpha) Selected_Features = SelectAndUpdateFeatures(Historical_MI, Selected_Features, Threshold) Yield Selected_Features Procedure CalculateMutualInformation(Batch, Target_Class): return [Feature: ComputeMutualInformation(Feature, Target_Class) for Feature in Batch] ProcedureUpdateFeatureRelevance(Historical_MI, Current_MI, Alpha): return [Feature: Alpha \(*\) Historical_MI.get(Feature, 0) + (1 \(-\) Alpha) \(*\) MI for Feature, MI in Current_MI.items()] ProcedureSelectAndUpdateFeatures(Historical_MI, Selected_Features, Threshold): return [Feature for Feature, MI in Historical_MI.items() if MI \(>\) Threshold or Feature in Selected_Features)
```  
**Algorithm 1** Incremental Mutual Information Selection (IMIS) [70].