# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 4 Experimental Evaluation and Analysis
### Phase 3
#### 4.4.1 UA-DES: Mathematical Steps and Algorithm  
To optimize the accuracy and efficiency of DBN training for ransomware detection, we developed an Uncertainty-Aware Dynamic Ensemble Selection (UA-DES) approach. This methodology employs Bayesian principles to model performance uncertainty, facilitating more informed decision-making throughout the training process. Specifically, we utilize dropout as a Bayesian approximation to quantify predictive uncertainty and implement Temperature Scaling to refine probability estimates. Furthermore, an active learning framework is incorporated to prioritize the selection of high-information samples, thereby maximizing training efficiency. The central innovation of Uncertainty-Aware Dynamic Ensemble Selection (UA-DES) resides in its dynamic stopping criterion. This criterion incorporates not only performance gains but also the model's predictive uncertainty and predefined quality benchmarks. By integrating these multifaceted factors, we ensure robust and reliable model generalization, culminating in enhanced accuracy and efficacy in ransomware detection. Figure 15 provides a schematic representation of the UA-DES architecture. To substantiate the implementation of UA-DES in DBN training, we have developed a rigorous mathematical formulation. This formulation precisely defines the constituent  
Figure 15: Schematic representation and data flow for the UA-DES training architecture. elements and procedural steps, providing a transparent and unambiguous framework for practical application. The UA-DES technique is designed to enhance the training process of a DBN-based ransomware detection model. This framework consists of five key steps:  
**Step 1. Bayesian Performance Modeling**  
* Performance Evaluation Based on Posterior Distribution:  
Let \(y\) be the actual label and \(\hat{y}\) be the label predicted by the DBN, which can be ransomware or benign. The performance metric \(P\) (e.g., accuracy, precision) can be modeled as  
\[P(\theta\mid D)=\frac{P(D\mid\theta)P(\theta)}{P(D)} \tag{20}\]  
Within the DBN framework, \(\theta\) denotes the model parameters, D represents the observed data, \(P\) (\(D\) \(\theta\)) signifies the likelihood of the data given the parameters (model evidence), \(P(\theta)\) represents the prior distribution of the parameters, and \(P(D)\) denotes the marginal likelihood of the data. Guided by empirical best practices and prior research, the DBN was configured for optimal performance with the following parameters: a batch size of 64, L2 regularization of 0.0002, momentum of 0.7, dropout rate of 0.2, and a learning rate of 0.05. To ensure the network focused on the most informative signals, API-based features were preselected using mutual information feature selection. * Uncertainty Estimation:  
Uncertainty in the performance metric P can be quantified by the variance of its posterior distribution:  
\[\sigma_{P}^{2}=Var[P(\theta\mid D)] \tag{21}\]  
**Step 2. Bayesian Approximation via Dropout: Stochastic Inference in DBNs**  
Bayesian inference within the DBN was approximated using stochastic forward passes with dropout. A dropout rate of 0.2 was implemented during training to simulate sampling from the posterior distribution and mitigate overfitting. By randomly deactivating neurons, dropout forced the network to learn more generalizable features. This stochasticity was limited to training; dropout was disabled for deterministic validation and testing. Training performance was used to optimize network weights and biases, while validation and testing metrics provided a comprehensive evaluation of predictive performance. For each pass \(n\), obtain prediction \(y^{n}\), then calculate the predictive uncertainty as  
\[Uncertainty=\frac{1}{N}\sum_{n-1}^{N}(\hat{y}_{n}-\overline{y})^{2} \tag{22}\]  
where \(\overline{y}\) is the mean prediction over the \(N\) passes. **Step 3.