## 3 The Methodology
### The Improved Generative Adversarial Network Model for Ransomware Early Detection
#### 3.1.2 Phase 2: The Early Detection Module  
In this phase, the augmented dataset generated during Phase 1 will be used to train the ransomware early detection model. The Long Short-Term Memory (LSTM) will be used to train a detection model. A set of informative features will be selected using the Mutual information Feature Selection (MIFS) according to Equation (6) as follows:  
\[J(X_{k})=I(X_{k};Y)-\beta\sum_{X_{j}\in S}I\left(X_{j};X_{k}\right)+\gamma\sum _{X_{j}\in S}I\left(X_{j};X_{k}\middle|Y\right) \tag{6}\]  
where \(I(X_{k};Y)\) is the mutual information between the candidate feature \(X_{k}\) and the class label \(Y\); \(I(X_{j};X_{k}\middle|Y)\) is the conditional mutual information between the candidate feature \(X_{k}\) and the feature \(X_{j}\) in the selected set \(S\), given the class label \(Y\); while \(\beta\) and \(\gamma\) are parameters (coefficients) with values between 0 and 1. The purpose of feature selection is to reduce data dimensionality, which avoids the overfitting problem that negatively affects the detection accuracy. By selecting the most relevant features, the model will also generate less false alarms, which contributes to higher precision as well. Furthermore, reducing data dimensionality helps to decrease the complexity of the model, which makes it suitable for real-time scenarios like ransomware early detection. The MIFS will rank the attributes based on the entropy, such that those with higher entropy value get lower rank. Then, the MIFS will select \(n\) top-ranking features, that will be used as inputs in the LSTM algorithm. The reason for using LSTM to build the detection module is due to its ability to remember the previous states, which is important property for ransomware early detection as it helps in tracking the progression of ransomware behavior during the pre-encryption phase. Therefore, the LSTM can trace the polymorphic behavior of the ransomware thanks to the cell state, which provides a bit memory to the LSTM so it can remember the past. The LSTM network is composed of three types of gates, namely input (Equation (7)), forget (Equation (8)), and output (Equation (9)):  
\[i_{t}=\sigma(\omega_{i}[h_{t-1},\ x_{t}+b_{i}]), \tag{7}\]  
\[i_{f}=\sigma(\omega_{f}[h_{t-1},\ x_{t}+b_{f}]), \tag{8}\]  
\[i_{o}=\sigma(\omega_{o}[h_{t-1},\ x_{t}+b_{o}]) \tag{9}\]  
where \(i_{t}\), \(i_{f}\), and \(i_{o}\) represent the input gate, forget gate, and the output gate. During the model's training, the LSTM will be trained using the data and selected features. The model is composed of several layers, namely input, output, and hidden. The number of nodes in the input layer is determined by the number of features selected by the MIFS. These nodes will receive data and process them to the hidden layer, after they multiply by the input weight. The hidden part of LSTM will be constructed using multiple layers. The number of hidden layers and nodes in each hidden layer will be optimized based on the bias factor during the training phase as well. In the hidden layers, the data will be processed based on the activation function used in the hidden nodes. The Relu function (Equation (10)) will be used as the activation function in all nodes in the hidden layers of LSTM, except the layer that precedes the output, where the sigmoid function (Equation (11)) will be used. The output layer receives the data from the sigmoid functions in the last hidden layer and determine whether the instance is malicious or normal based on a threshold where values greater than 0.5 are considered attacks. \[R(x)=\max(0,x) \tag{10}\]  
\[\varnothing(x)=\frac{1}{1+e^{-x}} \tag{11}\]  
The LSTM model is trained using the 10-fold cross validation method, where data is divided into two sets: training set and testing set. The training builds the model while testing evaluates the model's accuracy. The size of the training set is 90% of the data, and the testing set is 10% of the data. This process is repeated 10 times and the accuracy of the model will be recorded.