# Early Ransomware Detection with Deep Learning Models
## 5 Experimental Evaluation
### Results
#### 5.5.4 Data Preparation Times  
To verify that our best models are suitable for practical online RW detection, we measured the time it took to prepare the data before they were passed on to a model for detection. We performed these tests for different feature sets and text representations. These times (per entire test set) are reported in Table 6; we separated between data normalization, windowing, and text-feature encoding. Text encoding is a more time-consuming task, and its time rises with the expansion of feature sets. However, since the best models for both datasets use feature sets Ops and OpsRes, data preparation times for these setups are feasible for practical RW detection. On the PARSEC-500 dataset, the best neural model (CNN) uses a 1-hot text representation and OpsRes feature set. This combination takes less than 1 s to prepare for the entire test set of processes. This is also the case for the best model on the PARSEC-5000 dataset (LSTM) that uses 1-hot text representation and an Ops feature set.  
\begin{table}
\begin{tabular}{l l r r r} \hline \hline \multicolumn{5}{c}{PARSEC-500 dataset} \\ \hline \multirow{2}{*}{FLIST} & \multirow{2}{*}{text restr} & normalization+ & text features & total \\  & & windowing (s) & encoding (s) & time (s) \\ \hline Ops & BERT SE & 0.02 & 0.10 & 0.12 \\ Ops & FastText & 0.01 & 0.90 & 0.91 \\ Ops & 1-hot & 0.02 & 0.02 & 0.04 \\ OpsRes & BERT SE & 0.01 & 0.14 & 0.15 \\ OpsRes & FastText & 0.01 & 1.56 & 1.58 \\ \hline
**OpsRes** & **1-hot** & 0.01 & 0.01 & **0.02** \\ \hline OpsResDur & BERT SE & 1.84 & 0.17 & 2.01 \\ OpsResDur & FastText & 0.87 & 1.57 & 2.44 \\ OpsResDur & 1-hot & 0.40 & 12.00 & 12.41 \\ OpsResDurDet & BERT SE & 1.96 & 34.06 & 36.02 \\ OpsResDurDet & FastText & 1.03 & 6.69 & 7.72 \\ OpsResDurDet & 1-hot & 0.55 & 12.30 & 12.85 \\ \hline \multicolumn{5}{c}{PARSEC-5000 dataset} \\ \hline \multirow{2}{*}{FLIST} & \multirow{2}{*}{text restr} & normalization+ & text features & total \\  & & windowing (s) & encoding (s) & time (s) \\ \hline
**Ops** & **1-hot** & 0.36 & 0.10 & **0.46** \\ \hline Ops & BERT SE & 0.40 & 4.80 & 5.20 \\ Ops & FastText & 0.36 & 5.24 & 5.60 \\ OpsRes & 1-hot & 0.33 & 0.14 & 0.47 \\ OpsRes & BERT SE & 0.40 & 1.25 & 1.65 \\ OpsRes & FastText & 0.35 & 9.06 & 9.42 \\ OpsResDur & 1-hot & 3.40 & 8066.17 & 8069.58 \\ OpsResDur & BERT SE & 12.86 & 1.14 & 14.00 \\ OpsResDur & FastText & 6.36 & 9.11 & 15.47 \\ \hline \hline \end{tabular}
\end{table}
Table 6: Data preparation times for PARSEC-500 and PARSEC-500 datasets (top models configurations are marked in gray).  
\begin{table}
\begin{tabular}{l l l l l l} \hline \hline \multicolumn{5}{c}{**PARSEC-500 Dataset**} \\ \hline \multirow{2}{*}{**Model**} & \multirow{2}{*}{**text restr**} & **FLIST** & **W** & **ep** & **F1** \\ \hline CNN & 1-hot & OpsRes & 7 & 10 & **0.9903** \\ CNN & 1-hot & OpsRes & 7 & 30 & 0.9882 \\ LSTM & 1-hot & OpsRes & 7 & 10 & 0.9877 \\ DGNN1 & - & - & - & - & 0.9848 \\ DGNN1 & - & - & - & - & 0.9774 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Comparison with the models of [29] on the PARSEC-500 dataset (the best score is marked in gray).