Original: R ADIAL S PIKE AND S LAB B AYESIAN N EURAL N ETWORKS FOR S PARSE D ATA IN R ANSOMWARE A TTACKS
Revised: R ADIAL S PIKE AND S LAB B AYESIAN N EURAL N ETWORKS FOR S PARSE D ATA IN R ANSOMWARE A TTACKS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: Ransomware attacks are increasing at an alarming rate, leading to large financial losses, unrecoverable encrypted data, data leakage, and privacy concerns.
Revised: Ransomware attacks are increasing at an alarming rate, leading to large ﬁnancial losses, unrecoverable encrypted data, data leakage, and privacy concerns.

Original: The prompt detection of ransomware attacks is required to minimize further damage, particularly during the encryption stage.
Revised: The prompt detection of ransomware attacks is required to minimize further damage, particularly during the encryption stage.

Original: However, the frequency and structure of the observed ransomware attack data makes this task difficult to accomplish in practice.
Revised: However, the frequency and structure of the observed ransomware attack data makes this task difﬁcult to accomplish in practice.

Original: The data corresponding to ransomware attacks represents temporal, highdimensional sparse signals, with limited records and very imbalanced classes.
Revised: The data corresponding to ransomware attacks represents temporal, highdimensional sparse signals, with limited records and very imbalanced classes.

Original: While traditional deep learning models have been able to achieve state-of-the-art results in a wide variety of domains,
Revised: While traditional deep learning models have been able to achieve state-of-the-art results in a wide variety of domains,

Original: Bayesian Neural Networks, which are a class of probabilistic models, are better suited to the issues of the ransomware data.
Revised: Bayesian Neural Networks, which are a class of probabilistic models, are better suited to the issues of the ransomware data.

Original: These models combine ideas from Bayesian statistics with the rich expressive power of neural networks.
Revised: These models combine ideas from Bayesian statistics with the rich expressive power of neural networks.

Original: In this paper, we propose the Radial Spike and Slab Bayesian Neural
Revised: In this paper, we propose the Radial Spike and Slab Bayesian Neural

Original: Network, which is a new type of Bayesian Neural network that includes a new form of the approximate posterior distribution.
Revised: Network, which is a new type of Bayesian Neural network that includes a new form of the approximate posterior distribution.

Original: The model scales well to large architectures and recovers the sparse structure of target functions.
Revised: The model scales well to large architectures and recovers the sparse structure of target functions.

Original: We provide a theoretical justification for using this type of distribution, as well as a computationally efficient method to perform variational inference.
Revised: We provide a theoretical justiﬁcation for using this type of distribution, as well as a computationally efﬁcient method to perform variational inference.

Original: We demonstrate the performance of our model on a real dataset of ransomware attacks and show improvement over a large number of baselines, including state-of-the-art models such as Neural ODEs (ordinary differential equations).
Revised: We demonstrate the performance of our model on a real dataset of ransomware attacks and show improvement over a large number of baselines, including state-of-the-art models such as Neural ODEs (ordinary differential equations).

Original: In addition, we propose to represent low-level events as MITRE ATT&CK tactics, techniques, and procedures (TTPs) which allows the model to better generalize to unseen ransomware attacks.
Revised: In addition, we propose to represent low-level events as MITRE ATT&CK tactics, techniques, and procedures (TTPs) which allows the model to better generalize to unseen ransomware attacks.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Ransomware attacks are increasing rapidly and causing significant losses to governments, corporations, non-governmental organizations, and individuals.
Revised: Ransomware attacks are increasing rapidly and causing signiﬁcant losses to governments, corporations, non-governmental organizations, and individuals.

Original: The losses may include financial costs due to ransoms paid to decrypt assets, unrecoverable files when the ransom is not paid or the attacker fails to provide the decryption key, privacy and intellectual property theft when assets are exported, and even significant injury when ransomware impairs health care devices or patient records in hospitals.
Revised: The losses may include ﬁnancial costs due to ransoms paid to decrypt assets, unrecoverable ﬁles when the ransom is not paid or the attacker fails to provide the decryption key, privacy and intellectual property theft when assets are exported, and even signiﬁcant injury when ransomware impairs health care devices or patient records in hospitals.

Original: It is clear that the timely detection of ransomware incidents is necessary in order to minimize the number of assets that are encrypted or exfiltrated Urooj et al.
Revised: It is clear that the timely detection of ransomware incidents is necessary in order to minimize the number of assets that are encrypted or exﬁltrated (Urooj et al., 2021).

Original: To improve the ransomware response, this work proposes a new Bayesian Neural Network model that offers improved detection rates for organizations which employ analysts to protect their assets and networks.
Revised: To improve the ransomware response, this work proposes a new Bayesian Neural Network model that offers improved detection rates for organizations which employ analysts to protect their assets and networks.

Original: The problem is usually considered as a detection task, where the two classes are ransomware or not.
Revised: The problem is usually considered as a detection task, where the two classes are ransomware or not.

Original: The traditional methods of statistics and machine learning have been proposed to detect security threats in general and specifically ransomware in some cases.
Revised: The traditional methods of statistics and machine learning have been proposed to detect security threats in general and speciﬁcally ransomware in some cases.

Original: From the statistical perspective, a common approach is the application of Bayesian Networks

Original: Perusqu´ıa

Original:  et al. Oyen et al. (2016); Shin et al. (2015), whose main goal is to model the relationship between the observed signal and the class of the attack as a graphical model.
Revised: From the statistical perspective, a common approach is the application of Bayesian Networks (Perusqu´ıa et al., 2020; Oyen et al., 2016; Shin et al., 2015), whose main goal is to model the relationship between the observed signal and the class of the attack as a graphical model.

Original: From the machine learning perspective, a range of models were used to detect ransomware Alhawi et al. ; Poudyal et al. ; Zhang et al. Larsen et al.
Revised: From the machine learning perspective, a range of models were used to detect ransomware (Alhawi et al., 2018; Poudyal et al., 2018; Zhang et al., 2019; Larsen et al., 2021), such as Naive Bayes, Gradient Boosting, and Random Forests.

Original: (2021), such as Naive Bayes, Gradient Boosting, and Random Forests.

Original: Bottleneck.
Revised: Bottleneck.

Original: To obtain the rich expressive power of traditional deep learning models, training usually requires having access to a large number of records to successfully obtain robust generalized results.
Revised: To obtain the rich expressive power of traditional deep learning models, training usually requires having access to a large number of records to successfully obtain robust generalized results.

Original: Unfortunately, the frequency and structure of commonly observed data corresponding to ransomware attacks makes this task more difficult to accomplish.
Revised: Unfortunately, the frequency and structure of commonly observed data corresponding to ransomware attacks makes this task more difﬁcult to accomplish.

Original: In particular, ransomware attack data can be represented as temporal high-dimensional sparse signals, with a limited number of records and very imbalanced classes.
Revised: In particular, ransomware attack data can be represented as temporal high-dimensional sparse signals, with a limited number of records and very imbalanced classes.

Original: In our data, the percentage of ransomware attacks to non-ransomware attacks is 1% versus 99%, respectively.
Revised: In our data, the percentage of ransomware attacks to non-ransomware attacks is 1% versus 99%, respectively.

Original: Main ideas and contributions.
Revised: Main ideas and contributions.

Original: To address these unique features of the ransomware data, we first propose to represent ransomware signals according their MITRE ATT&CK tactics, techniques, and procedures (TTPs) which allows us to generalize ransomware and other attacks at a higher-level instead of the low-level detections associated with an individual attack.
Revised: To address these unique features of the ransomware data, we ﬁrst propose to represent ransomware signals according their MITRE ATT&CK tactics, techniques, and procedures (TTPs) which allows us to generalize ransomware and other attacks at a higher-level instead of the low-level detections associated with an individual attack.

Original: In addition, this allows for the detection of both human operated and automated ransomware attacks across multiple stages in the kill chain within an organization’s network.
Revised: In addition, this allows for the detection of both human operated and automated ransomware attacks across multiple stages in the kill chain within an organization’s network.

Original: Next, we propose a new probabilistic model which is called the Radial Spike and Slab Bayesian Neural Network.
Revised: Next, we propose a new probabilistic model which is called the Radial Spike and Slab Bayesian Neural Network.

Original: It is a Bayesian Neural Network, where the approximate posterior is represented by a mixture of distributions, resulting in a Radial
Revised: It is a Bayesian Neural Network, where the approximate posterior is represented by a mixture of distributions, resulting in a Radial

Original: Spike and Slab distribution.
Revised: Spike and Slab distribution.

Original: Our model provides the following benefits including: (1) the Spike and Slab component handles missing or sparse data, (2) the Radial component scales well with the growth of the number of parameters in the deep neural network, and (3) the Bayesian component prevents overfitting in the limited data setup.
Revised: Our model provides the following beneﬁts including: (1) the Spike and Slab component handles missing or sparse data, (2) the Radial component scales well with the growth of the number of parameters in the deep neural network, and (3) the Bayesian component prevents overﬁtting in the limited data setup.

Original: From the theoretical perspective, we provide the justification for using this type of distribution, as well as a computationally efficient method to perform variational inference.
Revised: From the theoretical perspective, we provide the justiﬁcation for using this type of distribution, as well as a computationally efﬁcient method to perform variational inference.

Original: In the results section, we demonstrate the performance of our model on a set of actual ransomware attacks and show improvement over a number of baselines, including the state-of-the-art temporal models such as RNNs Cho et al. and Neural ODEs (ordinary differential equations) Chen et al.
Revised: In the results section, we demonstrate the performance of our model on a set of actual ransomware attacks and show improvement over a number of baselines, including the state-of-the-art temporal models such as RNNs (Cho et al., 2014) and Neural ODEs (ordinary differential equations) (Chen et al., 2018).

Original: Thus, the proposed model is an important tool for the critical problem of ransomware detection.
Revised: Thus, the proposed model is an important tool for the critical problem of ransomware detection.

Original:  I NCIDENT D ATA D ESCRIPTION
Revised:  I NCIDENT D ATA D ESCRIPTION

Original: This work utilizes threat data provided by ‘our industry partner’ to detect ransomware and other types of cybersecurity attacks.
Revised: This work utilizes threat data provided by ‘our industry partner’ to detect ransomware and other types of cybersecurity attacks.

Original: Low-level event generators are manually created by analysts (i.e., signatures) and are provided with a UUID (Universally Unique Identifier).
Revised: Low-level event generators are manually created by analysts (i.e., signatures) and are provided with a UUID (Universally Unique Identiﬁer).

Original: Features.
Revised: Features.

Original: Given each incident, features need to be extracted which capture the range of attack behaviors observed across the kill chain and represent common behaviors across the different families of ransomware attacks.
Revised: Given each incident, features need to be extracted which capture the range of attack behaviors observed across the kill chain and represent common behaviors across the different families of ransomware attacks.

Original: The low-level events cannot be used directly because there are too many to train our model, given the number of labeled examples, and they do not generalize well individually.
Revised: The low-level events cannot be used directly because there are too many to train our model, given the number of labeled examples, and they do not generalize well individually.

Original: To overcome these problems, we map a subset of the low-level events into a higher-level representation using the MITRE ATT&CK framework MITRE.
Revised: To overcome these problems, we map a subset of the low-level events into a higher-level representation using the MITRE ATT&CK framework (MITRE).

Original: We chose the MITRE ATT&CK framework for the mapping because it provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) and is widely used across the industry for classifying attack behaviors and understanding the lifecycle of an attack.
Revised: We chose the MITRE ATT&CK framework for the mapping because it provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) and is widely used across the industry for classifying attack behaviors and understanding the lifecycle of an attack.

Original: Using the MITRE ATT&CK TTPs is a natural choice for features as it is generalizable, interpretable, and easy to acquire for this data as each low-level event from ‘the anonymized company’ is tagged with the MITRE technique associated with the alerted behavior MITRE.
Revised: Using the MITRE ATT&CK TTPs is a natural choice for features as it is generalizable, interpretable, and easy to acquire for this data as each low-level event from ‘the anonymized company’ is tagged with the MITRE technique associated with the alerted behavior (MITRE).

Original: For example, one of the features can represent whether ‘OS Credential Dumping’ happened or not.
Revised: For example, one of the features can represent whether ‘OS Credential Dumping’ happened or not.

Original: Additional MITRE ATT&CK features are included in Table 2, and the entire set is provided by the MITRE corporation MITRE (2022a).
Revised: Additional MITRE ATT&CK features are included in Table 2, and the entire set is provided by the MITRE corporation (MITRE, 2022a).

Original: The verbose definition of these features can be found in MITRE.
Revised: The verbose deﬁnition of these features can be found in (MITRE).

Original: For example, feature T1059.001 “Command and Scripting Interpreter,
Revised: For example, feature T1059.001 “Command and Scripting Interpreter,

Original: Powershell” corresponds to “Adversaries may abuse PowerShell commands and scripts for execution” MITRE (2022b).
Revised: Powershell” corresponds to “Adversaries may abuse PowerShell commands and scripts for execution” (MITRE, 2022b).

Original: In total, our data is a sparse binary, high-dimensional vector of size 706, which contains 298 MITRE ATT&CK features and 408 additional signature-based features, at each time point.
Revised: In total, our data is a sparse binary, high-dimensional vector of size 706, which contains 298 MITRE ATT&CK features and 408 additional signature-based features, at each time point.

Original: One of the primary characteristics of the data is sparsity because only very few actions are completed at each time step during the attack.
Revised: One of the primary characteristics of the data is sparsity because only very few actions are completed at each time step during the attack.

Original: Labels.
Revised: Labels.

Original: Using manual investigation, an analyst provides a label for each incident indicating whether it is due to a ransomware attack or another type of attack.
Revised: Using manual investigation, an analyst provides a label for each incident indicating whether it is due to a ransomware attack or another type of attack.

Original: The ransomware incidents include both human operated ransomware (HumOR) and automated ransomware attacks described in Appendix
Revised: The ransomware incidents include both human operated ransomware (HumOR) and automated ransomware attacks described in Appendix

Original: B in the Supplementary Material.
Revised: B in the Supplementary Material.

Original: However, our positive class label only indicates that an attack is ransomware and does not distinguish between the two classes of ransomware (i.e., HumOR, Automated).
Revised: However, our positive class label only indicates that an attack is ransomware and does not distinguish between the two classes of ransomware (i.e., HumOR, Automated).

Original: Our goal is to build an alarm-recommendation system, which can not only detect a possible ransomware attack, but also provide an estimate of the uncertainty about the decision.
Revised: Our goal is to build an alarm-recommendation system, which can not only detect a possible ransomware attack, but also provide an estimate of the uncertainty about the decision.

Original: We provide additional details about the training and testing data in Section 4.
Revised: We provide additional details about the training and testing data in Section 4.

Original: Ethics.
Revised: Ethics.

Original: As part of the production data collection process, all data has been processed to remove all personal identifiable information.
Revised: As part of the production data collection process, all data has been processed to remove all personal identiﬁable information.

Original: The datasets we received for this analysis only included a randomly assigned UUID for the organization, and the incidents that included the MITRE events, signature UUID identifiers and the labels.
Revised: The datasets we received for this analysis only included a randomly assigned UUID for the organization, and the incidents that included the MITRE events, signature UUID identiﬁers and the labels.

Original: The data was collected and adheres to the GDPR standard.
Revised: The data was collected and adheres to the GDPR standard.

Original: There are no negative societal impacts for creating models to protect users from ransomware.
Revised: There are no negative societal impacts for creating models to protect users from ransomware.

Original:  M ETHODOLOGY
Revised:  M ETHODOLOGY

Original: Important features of probabilistic models, such as providing a notion of uncertainty, dealing with missing data, and preventing overfitting in a limited data regime, have generated a strong interest in deep Bayesian learning.
Revised: Important features of probabilistic models, such as providing a notion of uncertainty, dealing with missing data, and preventing overﬁtting in a limited data regime, have generated a strong interest in deep Bayesian learning.

Original: In this section, we provide more details regarding Bayesian Neural
Revised: In this section, we provide more details regarding Bayesian Neural

Original: Networks, including different aspects of initializing and training the model.
Revised: Networks, including different aspects of initializing and training the model.

Original: We then propose the
Revised: We then propose the

Original: Radial Spike and Slab Bayesian Neural Network model to address the problems of the ransomware data.
Revised: Radial Spike and Slab Bayesian Neural Network model to address the problems of the ransomware data.

Original: Bayesian Neural Networks.
Revised: Bayesian Neural Networks.

Original: The main idea behind the Bayesian Neural Network is to consider all weights as being samples from a random distribution.
Revised: The main idea behind the Bayesian Neural Network is to consider all weights as being samples from a random distribution.

Original: Formally, we denote the observed data as ( x, y ) , where x is an input to the network, and y is a corresponding response.
Revised: Formally, we denote the observed data as ( x, y ) , where x is an input to the network, and y is a corresponding response.

Original: Let all weights of a
Revised: Let all weights of a

Original: BNN, W =
Revised: BNN, W =

Original: ( W 1 , . . .
Revised: ( W 1 , . . .

Original: , W D ) , be a random vector, where D is the depth (i.e., number of layers) of the
Revised: , W D ) , be a random vector, where D is the depth (i.e., number of layers) of the

Original: BNN and each W j = ( w j, 1 , . . . , w j,l j ) is a random vector itself of all weights w j,k per layer W j of size l j .
Revised: BNN and each W j = ( w j, 1 , . . . , w j,l j ) is a random vector itself of all weights w j,k per layer W j of size l j .

Original: To generate uncertainty of the prediction, we need to be able to compute p ( y | x ) .
Revised: To generate uncertainty of the prediction, we need to be able to compute p ( y | x ) .

Original: However, since all weights of a BNN are considered to be random variables, we can rewrite the conditional probability as p ( y | x ) = (cid:82) w p ( y, W | x ) dW = (cid:82) W p ( y | W, x ) p ( W | x ) dW .
Revised: However, since all weights of a BNN are considered to be random variables, we can rewrite the conditional probability as p ( y | x ) = ! [Equation] y, [Equation]

Revised: |

Original: Typically, the likelihood term p( y | W, x ) is defined by the problem setup, e.g., if we consider classification, as in ransomware incident detection, y ∼ Bern ( g ( W, x )) for some function g .
Revised: [Equation] [Equation] = ! W p

Revised: [Equation]

Revised: y | W, x ) p ( W | x ) dW .

Revised: Typically, the likelihood term p ( y | W, x ) is deﬁned by the problem setup, e.g., if we consider classiﬁcation, as in ransomware incident detection, y ∼ Bern ( g ( W, x )) for some function g .

Original: Then, the main problem of training a
Revised: Then, the main problem of training a

Original: BNN is to compute the posterior probability p
Revised: BNN is to compute the posterior probability p

Original: ( W | x ) , given the observed data x and a suitable prior for W .
Revised: ( W | x ) , given the observed data x and a suitable prior for W .

Original: In some simple cases of small neural networks, it may be possible to obtain a closed-form solution for the posterior if the prior and posterior are conjugate distributions.
Revised: In some simple cases of small neural networks, it may be possible to obtain a closed-form solution for the posterior if the prior and posterior are conjugate distributions.

Original: In other cases, if a closedform solution is unavailable, sampling-based strategies are required such as Markov Chain Monte
Revised: In other cases, if a closedform solution is unavailable, sampling-based strategies are required such as Markov Chain Monte

Original: Carlo schemes based on Gibbs or Metropolis Hasting samplers.
Revised: Carlo schemes based on Gibbs or Metropolis Hasting samplers.

Original: While such an approach provides excellent statistical behavior with theoretical support, scalability as a function of the dimensionality of the problem is known to be a serious issue.
Revised: While such an approach provides excellent statistical behavior with theoretical support, scalability as a function of the dimensionality of the problem is known to be a serious issue.

Original: The alternative for machine learning and vision problems is Variational Inference (VI) Graves (2011).
Revised: The alternative for machine learning and vision problems is Variational Inference (VI) (Graves, 2011).

Original: The core concept of VI is based on the fact that approximating the true posterior with another distribution may often be acceptable in practice.
Revised: The core concept of VI is based on the fact that approximating the true posterior with another distribution may often be acceptable in practice.

Original: The computational advantages of VI permit estimation procedures in cases which would not otherwise be feasible.
Revised: The computational advantages of VI permit estimation procedures in cases which would not otherwise be feasible.

Original: VI is now a mature technology, and its success has led to a number of follow-up developments focused on theoretical as well as practical aspects Blundell et al.
Revised: VI is now a mature technology, and its success has led to a number of follow-up developments focused on theoretical as well as practical aspects (Blundell et al., 2015).

Original: When using VI in Bayesian Neural Networks, we approximate the true unknown posterior distribution P
Revised: When using VI in Bayesian Neural Networks, we approximate the true unknown posterior distribution P

Original: ( W | x ) with an approximate posterior distribution Q θ of our choice , which depends on learned parameters θ .
Revised: ( W | x ) with an approximate posterior distribution Q θ of our choice , which depends on learned parameters θ .

Original: Let W θ =
Revised: Let W θ =

Original: ( W 1 θ , . .
Revised: ( W 1 θ , . .

Original: , W Dθ ) denote a random vector with distribution Q θ and probability distribution function (pdf) q θ .
Revised: , W D θ ) denote a random vector with distribution Q θ and probability distribution function (pdf) q θ .

Original: VI seeks to find θ such that Q θ is as close as possible to the real (unknown) posterior P ( W | x ) , and this is accomplished by minimizing the Kullback–Leibler ( KL ) divergence between Q θ and P ( W | x ) .
Revised: VI seeks to ﬁnd θ such that Q θ is as close as possible to the real (unknown) posterior P ( W | x ) , and this is accomplished by minimizing the Kullback–Leibler ( KL ) divergence between Q θ and P ( W | x ) .

Original: Given a prior pdf of weights, p , with a likelihood term p ( y | W, x ) , and the common mean field assumption of independence for W d and
Revised: Given a prior pdf of weights, p , with a likelihood term p ( y | W, x ) , and the common mean ﬁeld assumption of independence for W d and

Original: W dθ for d ∈ 1 , . . .
Revised: W d θ for d ∈ 1 , . . .

Original: , D , i.e., p ( W ) =
Revised: , D , i.e., p ( W ) =

Original: (cid:81)

Original: Dd =1 p d ( W d ) and q θ ( W θ ) =

Original: (cid:81)

Original: Dd =1 q dθ ( W dθ ) ,

Original: [Equation]
Revised: [Equation]

Original: By definition of the expected value E q θ , it is necessary to compute the multi-dimensional integral w.r.t w ∼ Q θ to solve equation 1.
Revised: By deﬁnition of the expected value E q θ , it is necessary to compute the multi-dimensional integral w.r.t w ∼ Q θ to solve equation 1.

Original: If such integrals are impossible to compute in a closed-form, a numerical approximation is used Ranganath et al.
Revised: If such integrals are impossible to compute in a closed-form, a numerical approximation is used (Ranganath et al., 2014;

Original: ; Paisley et al. ; Miller et al.
Revised: Paisley et al., 2012; Miller et al., 2017).

Original: For example, Monte Carlo (MC) sampling yields an asymptotically exact, unbiased estimator with variance O ( 1 M ) , where M is the number of samples.
Revised: For example, Monte Carlo (MC) sampling yields an asymptotically exact, unbiased estimator with variance O ( 1 M ) , where M is the number of samples.

Original: For a function g ( · ) :
Revised: For a function g ( · ) :

Original: [Equation]
Revised: [Equation]

Original: The expected value terms in equation 1 and equation 2 can be estimated by applying the method in equation 3, and in fact, even if a closed-form expression can be computed, an MC approximation may perform similarly given enough samples Blundell et al. (2015).
Revised: The expected value terms in equation 1 and equation 2 can be estimated by applying the method in equation 3, and in fact, even if a closed-form expression can be computed, an MC approximation may perform similarly given enough samples (Blundell et al., 2015).

Original: Given a mechanism to solve equation 1, the main consideration in VI is the choice of prior p and the approximate posterior q θ .
Revised: Given a mechanism to solve equation 1, the main consideration in VI is the choice of prior p and the approximate posterior q θ .

Original: A common choice for p and q θ is Gaussian, which allows calculating equation 2 in a closed-form.
Revised: A common choice for p and q θ is Gaussian, which allows calculating equation 2 in a closed-form.

Original: However, this type of distribution is mainly used for computational purposes and does not reflect the nature of the data.
Revised: However, this type of distribution is mainly used for computational purposes and does not reﬂect the nature of the data.

Original: Choosing the correct distribution, especially the one which can incorporate the features of the analyzed data, is an open problem Ghosh & Doshi-Velez (2017); Farquhar et al.
Revised: Choosing the correct distribution, especially the one which can incorporate the features of the analyzed data, is an open problem (Ghosh & Doshi-Velez, 2017; Farquhar et al., 2020;

Original: ; McGregor et al. ; Krishnan et al.
Revised: McGregor et al., 2019; Krishnan et al., 2019).

Original: In the next section, we discuss our proposed distribution, which naturally fits the data encountered in ransomware incident detection.
Revised: In the next section, we discuss our proposed distribution, which naturally ﬁts the data encountered in ransomware incident detection.

Original: While we give the description of the analyzed data in Section 2, we next describe the features of the data, which are important to encapsulate in the model design.
Revised: While we give the description of the analyzed data in Section 2, we next describe the features of the data, which are important to encapsulate in the model design.

Original: Spike and Slab distribution.
Revised: Spike and Slab distribution.

Original: The sparsity of the data is a common problem in many areas Kang (2013) and was previously approached from different perspectives.
Revised: The sparsity of the data is a common problem in many areas (Kang, 2013) and was previously approached from different perspectives.

Original: For example in the statistics community, sparsity can be addressed with both Stochastic Regression Imputation and Likelihood 
Revised: For example in the statistics community, sparsity can be addressed with both Stochastic Regression Imputation and Likelihood Based

Original: Based Approaches Lakshminarayan et al.
Revised: Approaches (Lakshminarayan et al., 1999).

Original: In the machine learning community, methods based on k-nearest neighbor Batista & Monard (2003) and iterative techniques Buuren & GroothuisOudshoorn (2010) have been developed, including approaches with neural networks Sharpe &Solly (1995); ´
Revised: In the machine learning community, methods based on k-nearest neighbor (Batista & Monard, 2003) and iterative techniques (Buuren & GroothuisOudshoorn, 2010) have been developed, including approaches with neural networks (Sharpe &

Original: Smieja et al.
Revised: Solly, 1995; ´Smieja et al., 2018).

Original: Another way to tackle sparsity comes from regularization theory via L1 regularization, e.g., group LASSO Meier et al. (2008), sparse group LASSO Simon et al. and graph LASSO Jacob et al.
Revised: Another way to tackle sparsity comes from regularization theory via L1 regularization, e.g., group LASSO (Meier et al., 2008), sparse group LASSO (Simon et al., 2013) and graph LASSO (Jacob et al., 2009).

Original: However, we are interested in a probabilistic approach to address the sparsity in our data.
Revised: However, we are interested in a probabilistic approach to address the sparsity in our data.

Original: From the probabilistic perspective, a common way to account for sparsity of the data in the model is to consider an appropriate distribution.
Revised: From the probabilistic perspective, a common way to account for sparsity of the data in the model is to consider an appropriate distribution.

Original: For example, the distribution can be the Horseshoe distribution Carvalho et al. (2009) or derivatives of the Laplace distribution Babacan et al.
Revised: For example, the distribution can be the Horseshoe distribution (Carvalho et al., 2009) or derivatives of the Laplace distribution (Babacan et al., 2009;

Original: ; Bhattacharya et al.
Revised: Bhattacharya et al., 2015).

Revised: Namely, in our case, we would like to model sparse data with a sparse probabilistic Bayesian neural network.

Revised: Since only a portion of the input variables are relevant to the response variable, we want the weights to be represented as on/off switches to understand whether we should account for the input variables.

Original: Another common way is, instead of one distribution, to consider the mixture of priors with Spike and Slab components which have been widely used for Bayesian variable selection Mitchell & Beauchamp (1988); George & McCulloch (1997).
Revised: Such a sparse Bayesian neural network can be represented by a ‘sparse‘ distribution on its weights, e.g., the mixture of priors with Spike and Slab components which have been widely used for Bayesian variable selection (Mitchell & Beauchamp, 1988; George & McCulloch, 1997).

Original: In general, the form of the Spike and Slab distribution for random variable w can be written as: w ∼ (1 − π ) δ ξ + πg , where π determines the probability for each mixture component, δ is spike component, which is modeled with a Dirac delta function such that δ ( w ) = (cid:26) + ∞ , w = ξ 0 , w ̸ = ξ and (cid:82) ∞
Revised: In general, the form of the Spike and Slab distribution for random variable w can be written as: w ∼ (1 − π ) δ ξ + π g , where π determines the probability for each mixture component, δ is spike component, which is modeled with a Dirac delta function such that δ ( w ) = ’ + ∞ , w = ξ 0 , w ∕ = ξ and ! ∞

Original: −∞ δ ( w ) dw = 1 , and g is the slab component, which is a general distribution of the practioner’s choice.
Revised: −∞ δ ( w ) dw = 1 , and g is the slab component, which is a general distribution of the practioner’s choice.

Original: The general idea is to explicitly introduce the sparsity component in the distribution of the data, allowing the probability mass to fully concentrate on ξ = 0 with probability 1 − π , and with probability π spread the remaining mass over the domain of the slab component g .
Revised: The general idea is to explicitly introduce the sparsity component in the distribution of the data, allowing the probability mass to fully concentrate on ξ =with probability 1 − π , and with probability π spread the remaining mass over the domain of the slab component g .

Original: Notice, that π can be considered as a random variable itself, e.g., π ∼ Bern ( λ ) , where λ is either a learned parameter or a fixed value that is provided by a specialist.
Revised: Notice, that π can be considered as a random variable itself, e.g., π ∼ Bern ( λ ) , where λ is either a learned parameter or a ﬁxed value that is provided by a specialist.

Original: The next questions to consider include: (1) how can the ‘Spike and Slab’ distribution be applied in a BNN, and (2) which slab component g should we consider?
Revised: The next questions to consider include: (1) how can the ‘Spike and Slab’ distribution be applied in a BNN, and (2) which slab component g should we consider?

Original: Spike and Slab BNN.
Revised: Spike and Slab BNN.

Original: In the BNN, all of the neural network’s weights W are considered to be random variables, and to use VI to solve equation 1 for each layer’s set of weights W j in W =
Revised: In the BNN, all of the neural network’s weights W are considered to be random variables, and to use VI to solve equation 1 for each layer’s set of weights W j in W =

Original: ( W 1 , . . .
Revised: ( W 1 , . . .

Original: , W D ) , it is necessary to provide the prior p j and the approximate posterior q jθ .
Revised: , W D ) , it is necessary to provide the prior p j and the approximate posterior q j θ .

Original: Without loss of generality, we consider a single weight w := w j,k , dropping the indices j and k , and only work with the prior p and the approximate posterior q for the remainder of this section.
Revised: Without loss of generality, we consider a single weight w := w j,k , dropping the indices j and k , and only work with the prior p and the approximate posterior q for the remainder of this section.

Original: Incorporating a Spike and Slab distribution on both the prior p and the approximate posterior q , samples w p from p and w q from q have the following distribution:
Revised: Incorporating a Spike and Slab distribution on both the prior p and the approximate posterior q , samples w p from p and w q from q have the following distribution:

Original: [Equation]
Revised: [Equation]

Original: where π p ∼ Bern ( λ p ) , π q ∼ Bern ( λ q ) , and g p , g q are distributions of our choice.
Revised: where π p ∼ Bern ( λ p ) , π q ∼ Bern ( λ q ) , and g p , g q are distributions of our choice.

Original: As we discussed previously, the main goal of VI is to learn parameters θ of an approximate posterior q θ , by minimizing equation 2.
Revised: As we discussed previously, the main goal of VI is to learn parameters θ of an approximate posterior q θ , by minimizing equation 2.

Original: In the case of equation 4, θ = ( λ q , θ q ) , where λ q is the probability of the Bernoulli distribution associated with π q , and θ q are the parameters of the Slab component g q .
Revised: In the case of equation 4, θ = ( λ q , θ q ) , where λ q is the probability of the Bernoulli distribution associated with π q , and θ q are the parameters of the Slab component g q .

Original: First, we state Theorem 3.1, which allows us to compute the KL term between two general Spike and Slab distributions.
Revised: First, we state Theorem 3.1, which allows us to compute the KL term between two general Spike and Slab distributions.

Original: Theorem 3.1.
Revised: Theorem 3.1.

Original: Given two general Spike and Slab distributions such that: p ( w | π p ) =
Revised: Given two general Spike and Slab distributions such that: p ( w | π p ) =

Original: (1 − π p )
Revised: (1 − π p )

Original: δ 0 ( w )+ π p g p ( w ) , q ( w | π q ) =
Revised: δ 0 ( w )+ π p g p ( w ) , q ( w | π q ) =

Original: (1 − π q ) δ 0 ( w ) + π q g q ( w ) , π p ∼ p ( π ) =
Revised: (1 − π q ) δ 0 ( w ) + π q g q ( w ) , π p ∼ p ( π ) =

Original: Bern ( λ p ) , and π q ∼ q ( π ) =
Revised: Bern ( λ p ) , and π q ∼ q ( π ) =

Original: Bern ( λ q ) , with δ 0 being a dirac delta function at 0 and g p , g q are the pdfs of the distributions of our choice, the KL ( q ( w, π ) ∥ p ( w, π )) is equal to: 
Revised: Bern ( λ q ) , with δ 0 being a dirac delta function at 0 and g p , g q are the pdfs of the distributions of our choice, the KL ( q ( w, π ) ’ p ( w, π )) is equal to: [Equation]

Original: [Equation]
Revised: [Equation]

Original: The proof is shown in Appendix F.
Revised: The proof is shown in Appendix F.

Original: Choice of g q and g p : Radial distribution.
Revised: Choice of g q and g p : Radial distribution.

Original: So far, we have shown results for a general Spike and
Revised: So far, we have shown results for a general Spike and

Original: Slab distribution.
Revised: Slab distribution.

Original: The important question is which slab components g should we consider for our approach, and if g q and g p should be from the same family?
Revised: The important question is which slab components g should we consider for our approach, and if g q and g p should be from the same family?

Original: Authors in Bai et al. (2020) considered both g q and g p to be the Gaussian distribution.
Revised: Authors in (Bai et al., 2020) considered both g q and g p to be the Gaussian distribution.

Original: However, there is emerging evidence Farquhar et al. (2020); Fortuin et al. (2020) that the Gaussian assumption results in poor performance of the medium to large-scale Bayesian Neural Networks.
Revised: However, there is emerging evidence (Farquhar et al., 2020; Fortuin et al., 2020) that the Gaussian assumption results in poor performance of the medium to large-scale Bayesian Neural Networks.

Original: Authors regard this as being caused by the probability mass in a high-dimensional Gaussian distribution concentrating in a narrow “soap-bubble” far from the mean.
Revised: Authors regard this as being caused by the probability mass in a high-dimensional Gaussian distribution concentrating in a narrow “soap-bubble” far from the mean.

Original: For this reason, Farquhar et al. (2020) proposed using a Radial distribution with parameters ( µ , σ ), where samples can be generated as:
Revised: For this reason, (Farquhar et al., 2020) proposed using a Radial distribution with parameters ( µ , σ ), where samples can be generated as:

Original: [Equation]
Revised: [Equation]

Original: Following Farquhar et al. (2020), we set up our approximate posterior g q to be the Radial distribution ( µ , σ ), while the prior g p is Normal(0, 1).
Revised: Following (Farquhar et al., 2020), we set up our approximate posterior g q to be the Radial distribution ( µ , σ ), while the prior g p is Normal(0, 1).

Original: Given equation 5, it is necessary to define the KL ( g q ∥ g p ) term.
Revised: Given equation 5, it is necessary to deﬁne the KL ( g q ’ g p ) term.

Original: Unfortunately, a closed-form solution for our choice of g q and g p is not available, and we approximate the KL term using Monte Carlo sampling from equation 3 with M samples.
Revised: Unfortunately, a closed-form solution for our choice of g q and g p is not available, and we approximate the KL term using Monte Carlo sampling from equation 3 with M samples.

Original: This process leads to (up to a constant): KL ( g q ∥ g p )
Revised: This process leads to (up to a constant): KL ( g q ’ g p )

Original: ≈ − log σ − 1 M (cid:80) Mi =1 log[ p ( w i )] , where w i is sampled from the Radial distribution ( µ , σ ) as described in equation 6 and p is the Likelihood of
Revised: ≈ − log σ − 1 M ( Mi =1 log[ p ( w i )] , where w i is sampled from the Radial distribution ( µ , σ ) as described in equation 6 and p is the Likelihood of

Original: N (0 , 1) .
Revised: N (0 , 1) .

Original: Note that running an MC approximation for large M can lead to running out of memory in either a GPU or RAM, Nazarovs et al.
Revised: Note that running an MC approximation for large M can lead to running out of memory in either a GPU or RAM, (Nazarovs et al., 2021).

Original: To tackle this issue, we follow Nazarovs et al. and apply a graph parameterization for our Radial Spike and Slab distribution, allowing us to set M = 1000 without exhausting the memory.
Revised: To tackle this issue, we follow (Nazarovs et al., 2021) and apply a graph parameterization for our Radial Spike and Slab distribution, allowing us to set M = 1000 without exhausting the memory.

Original: Reparameterization trick: Gumbel-Softmax.
Revised: Reparameterization trick: Gumbel-Softmax.

Original: Given Theorem 3.1, we can rewrite equation 1 as:
Revised: Given Theorem 3.1, we can rewrite equation 1 as:

Original: [Equation]
Revised: [Equation]

Original: Recall, we can compute the KL ( Bern ( λ q ) ∥
Revised: Recall, we can compute the KL ( Bern ( λ q ) ’

Original: Bern ( λ p )) in a closed-form (inside the proof of Theorem 3.1) and approximate the KL ( g q ∥ g p ) term with MC sampling.
Revised: Bern ( λ p )) in a closed-form (inside the proof of Theorem 3.1) and approximate the KL ( g q ’ g p ) term with MC sampling.

Original: Next, there are two main aspects left for our attention: (1) computing E q θ
Revised: Next, there are two main aspects left for our attention: (1) computing E q θ

Original: [ln p ( y | W, x )] , which is usually approximated with
Revised: [ln p ( y | W, x )] , which is usually approximated with

Original: Monte-Carlo sampling Kingma & Welling (2013) because of the intractability issue, and (2) how to do back-propagation for optimization.
Revised: Monte-Carlo sampling (Kingma & Welling, 2013) because of the intractability issue, and (2) how to do back-propagation for optimization.

Original: The problem with back-propagation in this setting is that sampling directly from, e.g., w ∼ N ( µ, σ ) with learnable parameters µ and σ , does not allow us to back-propagate through those parameters, and thus, they cannot be learned.
Revised: The problem with back-propagation in this setting is that sampling directly from, e.g., w ∼ N ( µ, σ ) with learnable parameters µ and σ , does not allow us to back-propagate through those parameters, and thus, they cannot be learned.

Original: This issue is addressed by applying a local-reparameterization trick Kingma et al.
Revised: This issue is addressed by applying a local-reparameterization trick (Kingma et al., 2015).

Original: For example, instead of sampling from w ∼ N ( µ, σ ) directly, we sample z ∼ N (0 , 1) and compute: w = µ + σz .
Revised: For example, instead of sampling from w ∼ N ( µ, σ ) directly, we sample z ∼ N (0 , 1) and compute: w = µ + σ z .

Original: This allows back-propagation to optimize the loss w.r.t.
Revised: This allows back-propagation to optimize the loss w.r.t.

Original: µ and σ .
Revised: µ and σ .

Original: While the local-reparameterization trick is obvious for members of a location-scale family, like the
Revised: While the local-reparameterization trick is obvious for members of a location-scale family, like the

Original: Gaussian distribution, and even for the selected Radial distribution, it is not clear how to apply this trick to the Bernoulli distribution, Bern ( λ ) .
Revised: Gaussian distribution, and even for the selected Radial distribution, it is not clear how to apply this trick to the Bernoulli distribution, Bern ( λ ) .

Original: One way to address this issue is to approximate samples from the Bernoulli distribution with the Gumbel-Softmax Maddison et al.
Revised: One way to address this issue is to approximate samples from the Bernoulli distribution with the Gumbel-Softmax (Maddison et al., 2016;

Original: ; Jang et al.
Revised: Jang et al., 2016;

Original: Bai et al.
Revised: Bai et al., 2020).

Original: That is, π ∼ Bern ( λ ) is approximated by (cid:101) π ∼ Gumbel-Softmax ( λ, τ ) , where (cid:101)
Revised: That is, π ∼ Bern ( λ ) is approximated by ) π ∼ Gumbel-Softmax ( λ , τ ) , where )

Original: π = (1 + exp ( − η/τ ))
Revised: π = (1 + exp ( − η / τ ))

Original: − 1 , η = log λ 1 − λ +log u 1 − u , and u ∼ U (0 , 1) .
Revised: − 1 , η = log λ 1 − λ +log u 1 − u , and u ∼ U (0 , 1) .

Original: Here, τ is the parameter which is referred as the temperature.
Revised: Here, τ is the parameter which is referred as the temperature.

Original: When τ approaches 0 , ˜ π converges in distribution to π .
Revised: When τ approaches 0 , ˜ π converges in distribution to π .

Original: However, in practice, τ is usually chosen no smaller than 0 .
Revised: However, in practice, τ is usually chosen no smaller than 0 .

Original: 5 for numerical stability Bai et al.
Revised: 5 for numerical stability (Bai et al., 2020).

Original: Applying the Gumbel-Softmax approximation instead of optimizing the loss for parameter λ q , we consider a new parameter θ π = log λ
Revised: Applying the Gumbel-Softmax approximation instead of optimizing the loss for parameter λ q , we consider a new parameter θ π = log λ

Original: q 1 − λ q .
Revised: q 1 − λ q .

Original: Thus, λ q = S ( θ π ) = 1 1+ e − θπ , resulting in the final learned parameters: θ = ( θ π , θ q ) .
Revised: Thus, λ q = S ( θ π ) = 1 1+ e − θπ , resulting in the ﬁnal learned parameters: θ = ( θ π , θ q ) .

Original: Final Loss and Method Summary.
Revised: Final Loss and Method Summary.

Original: A step-by-step summary of the method in provided in Algorithm 1.
Revised: A step-by-step summary of the method in provided in Algorithm 1.

Original: The final loss is given in Algorithm 2.
Revised: The ﬁnal loss is given in Algorithm 2.

Original:  • q ( w | π q ) =(1 −
Revised: [Table] • q ( w | π q ) =

Original:  q ) δ  w ) + π q g q  w ; µ, σ ) , • g q ( w ; µ, σ ) is pdf of Radial ( µ, σ ) • π q ∼ Bern( S ( θ π )) , where
Revised: (1 − π q ) δ 0 ( w ) + π q g q ( w ; µ, σ ) , • g q ( w ; µ, σ ) is pdf of Radial ( µ, σ ) • π q ∼ Bern

Original: is the softmax

Original:  Prior  and Slab  θ with  • p ( w | π p ) =
Revised: ( S ( θ π )) , where S is the softmax, and 4: Prior Spike and Slab distribution P θ with pdf p , s.t. • p ( w | π p ) =

Original: (1 − π p )
Revised: (1 − π p )

Original: δ 0 ( w ) + π p g p ( w ; µ p , σ p ) , • g p ( w ; µ p , σ p ) is pdf of Gaussian distribution • π p ∼ Bern ( π p )
Revised: δ 0 ( w ) + π p g p ( w ; µ p , σ p ) , • g p ( w ; µ p , σ p ) is pdf of Gaussian distribution • π p ∼ Bern ( π p )

Original: trick
Revised: Output: Learned parameters θ = ( θ π , µ, σ )

Original: Gumbel-
Revised: Require:

Original: Softmax
Revised: Prior distribution’s parameters ( π p , µ p , σ p ) 5: while θ has not converged do 6: Minimize VI loss in equation 8, by using gradient descent algorithms (e.g., SGD or Adam) and doing: 7: Forward pass : to compute • y with local reparameterization trick for both

Original:  KL terms and expected log-likelihood term, using combination of closed-form and MC[Table] [Table]
Revised: and Bernoulli (using Gumbel-Softmax) • KL terms and expected log-likelihood term, using combination of closed-form and MC

Original: while
Revised: Backward pass : compute gradients of θ

Original: Original:
Revised: Original:

Original: [Equation]
Revised: [Equation]

Original: Final:
Revised: Final:

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: Note that based on the mean field assumption of a BNN, the final loss L includes the sum over all KL j,k terms, which are computed for each k -th weight w j,k of the j -th layer of the BNN with parameters θ j,k = ( θ j,kπ , µ j,k , σ j,k ) .
Revised: [Equation]

Original: In this case, the final set of trainable parameters is θ = { θ j,k } for j = 1 , . . .
Revised: $

Original: , D and k = 1 , . . . , l j . In addition, E Q θ can be computed either in a closed-form or approximated by MC, depending on the complexity of  the BNN.
Revised: Note that based on the mean ﬁeld assumption of a BNN, the ﬁnal loss L includes the sum over all KL j,k terms, which are computed for each k -th weight w j,k

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: Data description.
Revised: Data description.

Original: As described previously in Section 2, each incident is represented by a temporal sequence of events from a knowledge base of TTPs with an assigned label, which indicates whether it is ransomware or another type of attack.
Revised: As described previously in Section 2, each incident is represented by a temporal sequence of events from a knowledge base of TTPs with an assigned label, which indicates whether it is ransomware or another type of attack.

Original: First, the company provided 201 incidents labeled as
Revised: First, the company provided 201 incidents labeled as

Original: Ransomware and 24,913 with Non-Ransomware labels for the initial dataset.
Revised: Ransomware and 24,913 with Non-Ransomware labels for the initial dataset.

Original: All of the samples in this dataset were deduplicated and included 706 sparse binary features.
Revised: All of the samples in this dataset were deduplicated and included 706 sparse binary features.

Original: This first dataset was randomly split with 80% of the examples assigned to the training set, while the remainder were used to create a validation set.
Revised: This ﬁrst dataset was randomly split with 80% of the examples assigned to the training set, while the remainder were used to create a validation set.

Original: Second, for the test set, we received a newer, deduplicated dataset making it independent of the training and validation sets.
Revised: Second, for the test set, we received a newer, deduplicated dataset making it independent of the training and validation sets.

Original: This dataset included 644 Ransomware incidents and 14,696 Non-Ransomware incidents.
Revised: This dataset included 644 Ransomware incidents and 14,696 Non-Ransomware incidents.

Original: Preprocessing of temporal information.
Revised: Preprocessing of temporal information.

Original: Some of the models such as the Neural ODE benefit from knowledge of the actual time associated with the recorded event, while others, including the RNN with a GRU cell, can be trained on the event sequence based solely on the event index (i.e., t=1,2,...).
Revised: Some of the models such as the Neural ODE beneﬁt from knowledge of the actual time associated with the recorded event, while others, including the RNN with a GRU cell, can be trained on the event sequence based solely on the event index (i.e., t=1,2,...).

Original: Finally, other models such as the fully connected and Bayesian Neural Networks can be trained and tested using the aggregation of all of the events in the event sequence.
Revised: Finally, other models such as the fully connected and Bayesian Neural Networks can be trained and tested using the aggregation of all of the events in the event sequence.

Original: To reduce the number of time steps for the time-based models for our study, we aggregated all TTP events observed within a one minute window.
Revised: To reduce the number of time steps for the time-based models for our study, we aggregated all TTP events observed within a one minute window.

Original: We set the aggregation time to one minute after doing hyperparameter tuning on this value.
Revised: We set the aggregation time to one minute after doing hyperparameter tuning on this value.

Original: This results in very few signals being recorded per aggregated time step, which is represented in Figure 1 in Appendix D.
Revised: This results in very few signals being recorded per aggregated time step, which is represented in Figure 1 in Appendix D.

Original: We see that the majority of the data have a small number of features that are set, namely less than 10 out of 706 possible.
Revised: We see that the majority of the data have a small number of features that are set, namely less than 10 out of 706 possible.

Original: For the neural network models, we aggregated all of the TTP features into a single input vector.
Revised: For the neural network models, we aggregated all of the TTP features into a single input vector.

Original: All of the sequences for the training and testing datasets were truncated after one hour from the time of the first event.
Revised: All of the sequences for the training and testing datasets were truncated after one hour from the time of the ﬁrst event.

Original: Models.
Revised: Models.

Original: In the experiments, we consider several baseline models from the traditional, temporal, and probabilistic deep learning settings, in addition to our proposed model.
Revised: In the experiments, we consider several baseline models from the traditional, temporal, and probabilistic deep learning settings, in addition to our proposed model.

Original: From the temporal perspective , we consider two models including the Recurrent Neural Network with a GRU cell (RNN) and the Neural ODE (NODE).
Revised: From the temporal perspective , we consider two models including the Recurrent Neural Network with a GRU cell (RNN) and the Neural ODE (NODE).

Original: As we mentioned earlier, the traditional recurrent neural network models (e.g., Simple RNN, GRU, LSTM) ignore the value of the time steps and only consider the order (i.e., index), in contrast to the Neural ODE which accounts for the time step value.
Revised: As we mentioned earlier, the traditional recurrent neural network models (e.g., Simple RNN, GRU, LSTM) ignore the value of the time steps and only consider the order (i.e., index), in contrast to the Neural ODE which accounts for the time step value.

Original: Note , we originally considered several temporal models, which do not account for the time value, like the traditional (i.e., Simple) RNN, the RNN with a GRU cell, the LSTM, and the Bi-directional LSTM.
Revised: Note , we originally considered several temporal models, which do not account for the time value, like the traditional (i.e., Simple) RNN, the RNN with a GRU cell, the LSTM, and the Bi-directional LSTM.

Original: However, among all of these models, the RNN with the GRU cell performed the best, and we only include this model in the analysis below.
Revised: However, among all of these models, the RNN with the GRU cell performed the best, and we only include this model in the analysis below.

Original: In addition we consider the traditional fully connected neural network (FC), and four BNN models.
Revised: In addition we consider the traditional fully connected neural network (FC), and four BNN models.

Original: The first two BNNs are the standard BNNs which have a Gaussian or Radial approximate posterior (BNN: Gaus, BNN: Radial), and the other two are the corresponding Spike and Slab versions, BNN:
Revised: The ﬁrst two BNNs are the standard BNNs which have a Gaussian or Radial approximate posterior (BNN: Gaus, BNN: Radial), and the other two are the corresponding Spike and Slab versions, BNN:

Original: Spike-Slab Gaussian and our proposed BNN: Spike-Slab Radial.
Revised: Spike-Slab Gaussian and our proposed BNN: Spike-Slab Radial.

Original: For these networks, we ignore the temporal aspect of the data by aggregating all available features per entry with the ‘logical or’ operator.
Revised: For these networks, we ignore the temporal aspect of the data by aggregating all available features per entry with the ‘logical or’ operator.

Original: Since our features are binary, aggregation corresponds to summarizing the information into the set of events which occurred during the time period.
Revised: Since our features are binary, aggregation corresponds to summarizing the information into the set of events which occurred during the time period.

Original: In addition, we also considered an approach with a Bayesian Network (i.e., not a BNN).
Revised: In addition, we also considered an approach with a Bayesian Network (i.e., not a BNN).

Original: However, the BN model failed to converge due to the sparsity and high dimensionality of the data.
Revised: However, the BN model failed to converge due to the sparsity and high dimensionality of the data.

Original: Furthermore, we also trained many variants of XGBoost Chen & Guestrin (2016), but all of the boosted decision tree models produced random results.
Revised: Furthermore, we also trained many variants of XGBoost (Chen & Guestrin, 2016), but all of the boosted decision tree models produced random results.

Original: Therefore, we did not include the results for XGBoost below.
Revised: Therefore, we did not include the results for XGBoost below.

Original: Parameter settings/hardware.
Revised: Parameter settings/hardware.

Original: All experiments were run on an NVIDIA P100.
Revised: All experiments were run on an NVIDIA P100.

Original: The code was implemented in PyTorch, using the Adam optimizer Kingma & Ba (2014) for all models, and trained for 400 epochs.
Revised: The code was implemented in PyTorch, using the Adam optimizer (Kingma & Ba, 2014) for all models, and trained for 400 epochs.

Original: The model with the lowest validation loss was selected for evaluation.
Revised: The model with the lowest validation loss was selected for evaluation.

Original: The final hyperparameter settings are specified in Appendix A.
Revised: The ﬁnal hyperparameter settings are speciﬁed in Appendix A.

Original: Ablation study.
Revised: Ablation study.

Original: To understand the effect of the distribution on the BNN, we conduct an ablation study between the Gaussian BNN, Radial BNN, and their Spike and Slab versions.
Revised: To understand the effect of the distribution on the BNN, we conduct an ablation study between the Gaussian BNN, Radial BNN, and their Spike and Slab versions.

Original: We provide results in Table 1.
Revised: We provide results in Table 1.

Original: Clearly our proposed method provides better results in a number of metrics, including Specificity, Precision, F1, and FPR, which are important for Ransomware detection.ValidationSet [Figure] Statistics
Revised: Clearly our proposed method provides better results in a number of metrics, including Speciﬁcity, Precision, F1, and FPR, which are important for Ransomware detection.

Original: [Figure]

Original: Model Evaluation.
Revised: Model Evaluation.

Original: In Figure 1, we provide the ROC curves for the proposed model and several baselines.
Revised: In Figure 1, we provide the ROC curves for the proposed model and several baselines.

Original: For our Radial Spike and Slab BNN method and the Gaussian BNN method, we display the distribution of each model’s
Revised: For our Radial Spike and Slab BNN method and the Gaussian BNN method, we display the distribution of each model’s

Original: ROC curves, shaded in green, together with its mean value (e.g., green line).
Revised: ROC curves, shaded in green, together with its mean value (e.g., [Figure]

Original:  Figure 1a shows that, with respect to the distribution of the ROC curves, our model outperforms the baselines on average, particularly in the region of small false positive rates, Figure 1b, which is the most important for ransomware detection.
Revised: 0.73 F0. 0.21 G-Mean 0. green line). Figure 1a shows that, with respect to the distribution of the ROC curves, our model outperforms the baselines on average, particularly in the region of small false positive rates, Figure 1b, which is the most important for ransomware detection.

Original: In addition, the Radial Spike and Slab BNN is able to provide a range of ROC curves which are significantly higher than the other baselines, if we consider the margins of the ROC distribution.
Revised: In addition, the Radial Spike and Slab BNN is able to provide a range of ROC curves which are signiﬁcantly higher than the other baselines, if we consider the margins of the ROC distribution.

Original: Looking at the columns for the validation and testing set in Table 1, we see that proposed BNN model outperforms the baseline methods, w.r.t.
Revised: Looking at the columns for the validation and testing set in Table 1, we see that proposed BNN model outperforms the baseline methods, w.r.t.

Original: to
Revised: to

Original: AUC, accuracy, G-Mean, and other statistics.
Revised: AUC, accuracy, G-Mean, and other statistics.

Original: [Figure]
Revised: [Figure]

Original: Training and Test Times.
Revised: Training and Test Times.

Original: Training the Radial Spike and Slab Bayesian Neural Network in a single
Revised: Training the Radial Spike and Slab Bayesian Neural Network in a single

Original: Azure-hosted Linux VM with an NVIDIA P100 for 400 epochs required 1 hour, 32 minutes andseconds.
Revised: Azure-hosted Linux VM with an NVIDIA P100 for 400 epochs required 1 hour, 32 minutes andseconds.

Original: The time required to evaluate the 15,340 samples in the test set was 19 seconds.
Revised: The time required to evaluate the 15,340 samples in the test set was 19 seconds.

Original: However, to create a confidence interval (CI), the evaluation is repeated 100 times.
Revised: However, to create a conﬁdence interval (CI), the evaluation is repeated 100 times.

Original: Thus, 19 seconds corresponds to 100 evaluations.
Revised: Thus, 19 seconds corresponds to 100 evaluations.

Original: We re-ran inference on an NVIDIA A100 for all of the models to compare to 1 run of deterministic models.
Revised: We re-ran inference on an NVIDIA A100 for all of the models to compare to 1 run of deterministic models.

Original: The results include 4.07 sec (1 iteration) and 10.37 sec (100 iterations for CI) for the BNN: Radial Spike & Slab (ours), 4.02 sec for the BNN: Gaussian, 7.72 sec for Fully Connected NN (FC), 3.12 sec for the Neural ODE, and 2.35 sec for the RNN-GPU.
Revised: The results include 4.07 sec (1 iteration) and 10.37 sec (100 iterations for CI) for the BNN: Radial Spike & Slab (ours), 4.02 sec for the BNN: Gaussian, 7.72 sec for Fully Connected NN (FC), 3.12 sec for the Neural ODE, and 2.35 sec for the RNN-GPU.

Original: Feature Importance and Interpretation.
Revised: Feature Importance and Interpretation.

Original: [Table]

Original: We would like to understand which TTP features of the attack are considered to be important by our model when making a prediction whether an attack is ransomware or not.
Revised: We would like to understand which TTP features of the attack are considered to be important by our model when making a prediction whether an attack is ransomware or not.

Original: One way to do this is to investigate the posterior probabilities for the first layer weights of the BNN.
Revised: One way to do this is to investigate the posterior probabilities for the ﬁrst layer weights of the BNN.

Original: However, while understanding the importance of the TTP features based on the BNN’s trained weights conceptually makes sense, we instead follow a more well-known and established way to interpret the features of a general neural network, called Integrated Gradients Sundararajan et al.
Revised: However, while understanding the importance of the TTP features based on the BNN’s trained weights conceptually makes sense, we instead follow a more well-known and established way to interpret the features of a general neural network, called Integrated Gradients (Sundararajan et al., 2017).

Original: Both methods are discussed in Appendix E.
Revised: Both methods are discussed in Appendix E.

Original: In Table 2, we present the subset of features which are the most important for our model to identify whether an attack is ransomware or some other type of attack based on Integrated Gradients.
Revised: In Table 2, we present the subset of features which are the most important for our model to identify whether an attack is ransomware or some other type of attack based on Integrated Gradients.

Original: Sorting the values of Integrated Gradients, we find that the MITRE ATT&CK features are significantly more important than the signature-based features.
Revised: Sorting the values of Integrated Gradients, we ﬁnd that the MITRE ATT&CK features are signiﬁcantly more important than the signature-based features.

Original: The “signature” in Table 2 is a low-level event generator from an analyst.
Revised: The “signature” in Table 2 is a low-level event generator from an analyst.

Original: As Tableshows, the MITRE events are much more important than the low-level signatures.
Revised: As Table 2 shows, the MITRE events are much more important than the low-level signatures.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original:  Recently, ransomware has become an active research area Oz et al. ; McIntosh et al.
Revised: [Table] Recently, ransomware has become an active research area (Oz et al., 2022; McIntosh et al., 2021).

Original: Machine learning approaches have been proposed for the detection of ransomware attacks.
Revised: Machine learning approaches have been proposed for the detection of ransomware attacks.

Original: A stacked, variational autoencoder is used to detect ransomware in the industrial IoT (IIoT) setting AlHawawreh & Sitnikova (2019).
Revised: A stacked, variational autoencoder is used to detect ransomware in the industrial IoT (IIoT) setting (Al-Hawawreh & Sitnikova, 2019).

Original: System API calls are used to detect ransomware using Decision Trees, a K-Nearest Neighbor classifier, and a Random Forest in Sheen & Yadav (2018).
Revised: System API calls are used to detect ransomware using Decision Trees, a K-Nearest Neighbor classiﬁer, and a Random Forest in (Sheen & Yadav, 2018).

Original: Takeuchi et al.
Revised: Takeuchi et al.

Original: Takeuchi et al. (2018) also proposed using an SVM to detect ransomware using System API calls.
Revised: (Takeuchi et al., 2018) also proposed using an SVM to detect ransomware using System API calls.

Original: Agrawal et al.
Revised: Agrawal et al.

Original: Agrawal et al. (2019) proposed a new attention mechanism on the input vector of an LSTM, an RNN and a GRU to improve the detection of ransomware attacks from API calls.
Revised: (Agrawal et al., 2019) proposed a new attention mechanism on the input vector of an LSTM, an RNN and a GRU to improve the detection of ransomware attacks from API calls.

Original: An ensemble of network traffic classifiers are used to detect network packets and flows for the Locky family of ransomware in Almashhadani et al.
Revised: An ensemble of network trafﬁc classiﬁers are used to detect network packets and ﬂows for the Locky family of ransomware in (Almashhadani et al., 2019).

Original: A Bayesian Network was the best performing flow-based classifier in this work while a Random Tree was the best for detecting packets in this work.
Revised: A Bayesian Network was the best performing ﬂow-based classiﬁer in this work while a Random Tree was the best for detecting packets in this work.

Original: HelDroid Andronio et al. (2015) uses natural language processing techniques, along with static and dynamic analysis, to detect ransomware on mobile computing devices.
Revised: HelDroid (Andronio et al., 2015) uses natural language processing techniques, along with static and dynamic analysis, to detect ransomware on mobile computing devices.

Original: Adamov and
Revised: Adamov and

Original: Carlsson Adamov & Carlsson (2020) use reinforcement learning to simulate ransomware attacks for testing ransomware detectors.
Revised: Carlsson (Adamov & Carlsson, 2020) use reinforcement learning to simulate ransomware attacks for testing ransomware detectors.

Original: Urooj et al.
Revised: Urooj et al.

Original: Urooj et al. (2021) proposed an online classifier to predict early stage ransomware, but they do not provide any details for the classifier itself.
Revised: (Urooj et al., 2021) proposed an online classiﬁer to predict early stage ransomware, but they do not provide any details for the classiﬁer itself.

Original:  L IMITATIONS AND C ONCLUSION
Revised:  L IMITATIONS AND C ONCLUSION

Original: In this work, we propose the new Radial Spike and Slab Bayesian Neural Network and demonstrate that it outperforms the standard Bayesian Neural Network and other deep learning methods for the task of detecting ransomware attacks within the general class of all attacks, such as the dropping of commodity malware.
Revised: In this work, we propose the new Radial Spike and Slab Bayesian Neural Network and demonstrate that it outperforms the standard Bayesian Neural Network and other deep learning methods for the task of detecting ransomware attacks within the general class of all attacks, such as the dropping of commodity malware.

Original: The results can provide an early indicator of a potential ransomware attack for analysts to be able to confirm with additional investigation.
Revised: The results can provide an early indicator of a potential ransomware attack for analysts to be able to conﬁrm with additional investigation.

Original: While the model is able to learn to distinguish between ransomware attacks and other attacks, the
Revised: While the model is able to learn to distinguish between ransomware attacks and other attacks, the

Original: ROC curve indicates that it cannot be used by a fully automated system to completely disable computers or block network access due to a potential ransomware outbreak.
Revised: ROC curve indicates that it cannot be used by a fully automated system to completely disable computers or block network access due to a potential ransomware outbreak.

Original: However, since these attacks are being diagnosed by analysts, we believe that the model can alert these analysts about possible active ransomware attack on their network.
Revised: However, since these attacks are being diagnosed by analysts, we believe that the model can alert these analysts about possible active ransomware attack on their network.

Original: Given that ransomware attacks are relatively rare compared to the downloading of commodity malware, the amount of labeled data for these types of attacks is small.
Revised: Given that ransomware attacks are relatively rare compared to the downloading of commodity malware, the amount of labeled data for these types of attacks is small.

Original: The size of our datasets from a production security service reflects this limitation.
Revised: The size of our datasets from a production security service reﬂects this limitation.

Original: Fortunately, Bayesian computational methods such as Bayesian Neural Networks can be used for training and inference without overfitting in scenarios where the amount of labeled data is limited.
Revised: Fortunately, Bayesian computational methods such as Bayesian Neural Networks can be used for training and inference without overﬁtting in scenarios where the amount of labeled data is limited.

Original: In addition to security problems, two significant areas, which focus on the analysis of highdimensional sparse data, are Biostatistics and Genetics.
Revised: In addition to security problems, two signiﬁcant areas, which focus on the analysis of highdimensional sparse data, are Biostatistics and Genetics.

Original: While there are notable developments in sparse methods in those areas, our proposed method is novel for them as well.
Revised: While there are notable developments in sparse methods in those areas, our proposed method is novel for them as well.

Original: Once the source code is public, we hope that researchers from other fields will find the proposed model useful.
Revised: Once the source code is public, we hope that researchers from other ﬁelds will ﬁnd the proposed model useful.

Original: A H YPERPARAMETER S ETTINGS
Revised: A H YPERPARAMETER S ETTINGS

Original: For reproducibility, this appendix provides the hyperparameter settings used for the proposed model as well as those for the baseline models.
Revised: For reproducibility, this appendix provides the hyperparameter settings used for the proposed model as well as those for the baseline models.

Original: The best general hyperparameter settings from tuning are provided in Table 3.
Revised: The best general hyperparameter settings from tuning are provided in Table 3.

Original: Other network hyperparameter are included in Table 4.
Revised: Other network hyperparameter are included in Table 4.

Original: The hyperparameters for the RNN, ODE, Fully Connected, and Bayesian models are provided in Tables, 5, 6, 7, and 8, respectively.
Revised: The hyperparameters for the RNN, ODE, Fully Connected [Table] and Bayesian models are provided in Tables, 5, 6, 7, and 8, respectively

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: B R ANSOMWARE A TTACKS
Revised: B R ANSOMWARE A TTACKS

Original: Ransomware attacks fall into two main categories, automated ransomware which include infamous cases such as WannaCry, and human operated ransomware (HumOR) conducted by actor groups such as REvil and a myriad of others.
Revised: Ransomware attacks fall into two main categories, automated ransomware which include infamous cases such as WannaCry, and human operated ransomware (HumOR) conducted by actor groups such as REvil and a myriad of others.

Original: Although automated ransomware involves humans, the distribution of the payload usually does not involve human interaction.
Revised: Although automated ransomware involves humans, the distribution of the payload usually does not involve human interaction.

Original: HumOR attacks, however, involve hands-on-keyboard activity, where an active human adversary has gained access to a network – whether through purchased access, malware, vulnerabilities [Table] or other means – and progresses through the kill chain to escalate privileges, move laterally if possible, and distribute ransomware in the environment.
Revised: HumOR attacks, however, involve hands-on-keyboard activity, where an active human adversary has gained access to a network – whether through purchased access, malware, vulnerabilities, or other means – and progresses through the kill chain to escalate privileges, move laterally if possible, and distribute ransomware in the environment.

Original: Human operated attacks tend to be more severe, as the adversary is able to take steps to bypass protections and work to ensure the ransomware payload is executed successfully.
Revised: Human operated attacks tend to be more severe, as the adversary is able to take steps to bypass protections and work to ensure the ransomware payload is executed successfully.

Original: Security solutions will actively monitor for these suspicious events across the different kill chain stages in a ransomware attack to detect and alert on the malicious behaviors.
Revised: Security solutions will actively monitor for these suspicious events across the different kill chain stages in a ransomware attack to detect and alert on the malicious behaviors.

Original: Ransomware attackers will typically utilize multiple toolkits, custom malware, and scripts to conduct their activity more effectively.
Revised: Ransomware attackers will typically utilize multiple toolkits, custom malware, and scripts to conduct their activity more effectively.

Original: Often this can also entail multiple operators for different stages in the kill chain, such as with Ransomware-as-a-Service (RaaS) attacks.
Revised: Often this can also entail multiple operators for different stages in the kill chain, such as with Ransomware-as-a-Service (RaaS) attacks.

Original: RaaS involves operators who work to create tools and provide access for vetted attackers – known as affiliates - to conduct the majority of the ransomware attack.
Revised: RaaS involves operators who work to create tools and provide access for vetted attackers – known as afﬁliates - to conduct the majority of the ransomware attack.

Original: Complicating matters, many of the tools ransomware attackers frequently use are open-source and have legitimate purposes, preventing outright detection and blocking unless the method of using the tools can specifically be classified as malicious.
Revised: Complicating matters, many of the tools ransomware attackers frequently use are open-source and have legitimate purposes, preventing outright detection and blocking unless the method of using the tools can speciﬁcally be classiﬁed as malicious.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: There are several challenges for detecting and blocking ransomware attacks.
Revised: There are several challenges for detecting and blocking ransomware attacks.

Original: First, there is a time criticality required for detection prior to the distribution and encryption of devices.
Revised: First, there is a time criticality required for detection prior to the distribution and encryption of devices.

Original: Ideally, a good ransomware detection service can detect a ransomware attack prior to the encryption of any assets.
Revised: Ideally, a good ransomware detection service can detect a ransomware attack prior to the encryption of any assets.

Original: This necessitates detecting the compromise as early in the kill chain as possible.
Revised: This necessitates detecting the compromise as early in the kill chain as possible.

Original: However, the early stages of an attack do not necessarily have clear and specific implications of ransomware and can often mirror attacks that are not ransomware in nature.
Revised: However, the early stages of an attack do not necessarily have clear and speciﬁc implications of ransomware and can often mirror attacks that are not ransomware in nature.

Original: Second, although ransomware attacks are increasing and regularly reported in the news, they are still rare, and the labeled data is limited.
Revised: Second, although ransomware attacks are increasing and regularly reported in the news, they are still rare, and the labeled data is limited.

Original: Therefore, a ransomware detector must not overfit to sparse data.
Revised: Therefore, a ransomware detector must not overﬁt to sparse data.

Original: In addition, a ransomware detection service must have access to signals from a large number of computers or mobile devices in order to create datasets that can learn to detect important behaviors.
Revised: In addition, a ransomware detection service must have access to signals from a large number of computers or mobile devices in order to create datasets that can learn to detect important behaviors.

Original: Third, the system must generalize to handle polymorphism since the signals are polymorphic by their nature.
Revised: Third, the system must generalize to handle polymorphism since the signals are polymorphic by their nature.

Original: Attackers may delay or reorder their activity, utilize open-source legitimate tools for malicious purposes, use polymorphic malware (e.g., backdoors) or scripts, or fast flux networks for command and control to avoid detection.
Revised: Attackers may delay or reorder their activity, utilize open-source legitimate tools for malicious purposes, use polymorphic malware (e.g., backdoors) or scripts, or fast ﬂux networks for command and control to avoid detection.

Original: Finally, the input signals are often weak and often do not indicate a ransomware attack on their own.
Revised: Finally, the input signals are often weak and often do not indicate a ransomware attack on their own.

Original: An effective ransomware detection service must be able to combine these low-level signals in order to produce a successful high-level detection.
Revised: An effective ransomware detection service must be able to combine these low-level signals in order to produce a successful high-level detection.

Original: C T HREAT M ODEL
Revised: C T HREAT M ODEL

Original: The BNN ransomware detector operates on data collected from the < the anonymized company’s > currently operational backend security system.
Revised: The BNN ransomware detector operates on data collected from the < the anonymized company’s > currently operational backend security system.

Original: This system processes the low-level events which are generated by the device and stored in a cloud service, or alternatively on-premise, and, like all security services, this creates several areas which must be protected from attack.
Revised: This system processes the low-level events which are generated by the device and stored in a cloud service, or alternatively on-premise, and, like all security services, this creates several areas which must be protected from attack.

Original: The low-level events are generated by the device itself in kernel mode of the operating system.
Revised: The low-level events are generated by the device itself in kernel mode of the operating system.

Original: The system assumes that the events are successfully generated, transmitted, and received by the cloud or on-premise backend service, and that the events have not been altered by the actor using a person-in-the-middle attack.
Revised: The system assumes that the events are successfully generated, transmitted, and received by the cloud or on-premise backend service, and that the events have not been altered by the actor using a person-in-the-middle attack.

Original: Next, the system assumes that the events have not been altered once they have received and stored in the backend service itself.
Revised: Next, the system assumes that the events have not been altered once they have received and stored in the backend service itself.

Original: Thus, the system assumes that there are no successful data poisoning or insider threat attacks.
Revised: Thus, the system assumes that there are no successful data poisoning or insider threat attacks.

Original: Finally, the system assumes that the ransomware alerts are successfully transmitted to and correctly received by the customer’s and the < the anonymized company’s > analysis portals.
Revised: Finally, the system assumes that the ransomware alerts are successfully transmitted to and correctly received by the customer’s and the < the anonymized company’s > analysis portals.

Original: It should be noted that all of these system components are operational today, and the proposed model only affects the processing component in the backend service.
Revised: It should be noted that all of these system components are operational today, and the proposed model only affects the processing component in the backend service.

Original: D T EMPORAL P RE P ROCESSING
Revised: D T EMPORAL P RE P ROCESSING

Original: In this appendix, we investigate the sparsity of the raw dataset.
Revised: In this appendix, we investigate the sparsity of the raw dataset.

Original: In Figure 2, we show the distribution of the number of features that are set during each single one minute time step (i.e., time interval) in the raw data.
Revised: In Figure 2, we show the distribution of the number of features that are set during each single one minute time step (i.e., time interval) in the raw data.

Original: In general, ten or fewer features are set during a single one minute time interval.
Revised: In general, ten or fewer features are set during a single one minute time interval.

Original: A few one minute time steps have between 10 and 20 features that are set, while a small number of others have between 40 and 55 features set.
Revised: A few one minute time steps have between 10 and 20 features that are set, while a small number of others have between 40 and 55 features set.

Original: Interestingly, we found that none of the time steps had between 20 and 40 features set.
Revised: Interestingly, we found that none of the time steps had between 20 and 40 features set.

Original: [Table]
Revised: [Table]

Original: E F EATURE I MPORTANCE AND I NTERPRETATION D ETAILS
Revised: E F EATURE I MPORTANCE AND I NTERPRETATION D ETAILS

Original: In this appendix, we discuss two methods to determine the most important features for the Radial
Revised: In this appendix, we discuss two methods to determine the most important features for the Radial

Original: Spike and Slab Bayesian Neural Network ransomware detection model.
Revised: Spike and Slab Bayesian Neural Network ransomware detection model.

Original: The first method we consider is to rank the posterior probabilities which are found in the first layer weights of the BNN.
Revised: The ﬁrst method we consider is to rank the posterior probabilities which are found in the ﬁrst layer weights of the BNN.

Original: Recall that the core idea behind a BNN with Spike and Slab distributions is to learn a parameter θ π , which models the probability S ( θ π ) of each node in the neural network to be included.
Revised: Recall that the core idea behind a BNN with Spike and Slab distributions is to learn a parameter θ π , which models the probability S ( θ π ) of each node in the neural network to be included.

Original: Given that the first layer of the BNN is fully connected, we can consider S ( θ π ) of the first layer as the importance of each TTP for our network.
Revised: Given that the ﬁrst layer of the BNN is fully connected, we can consider S ( θ π ) of the ﬁrst layer as the importance of each TTP for our network.

Original: Since we suspect that not all TTPs are equally important, we expect to observe spikes in the learned S ( θ π ) .
Revised: Since we suspect that not all TTPs are equally important, we expect to observe spikes in the learned S ( θ π ) .

Original: The results in Figure 3 confirm this hypothesis, where we start from the uninformative, uniform prior (left) and generate spikes in the learned S ( θ π ) (right) after training.
Revised: The results in Figure 3 conﬁrm this hypothesis, where we start from the uninformative, uniform prior (left) and generate spikes in the learned S ( θ π ) (right) after training.

Original: However, while understanding which TTP features are important based on the BNN’s −→ trained weights conceptually makes sense, we instead follow a more well-known and established way to interpret the features of a general neural network, called Integrated Gradients Sundararajan et al. (2017) as the second method to rank the features.
Revised: However, while understanding which TTP features are important based on the BNN’s −→ trained weights conceptually makes sense, we instead follow a more well-known and established way to interpret the features of a general neural network, called Integrated Gradients (Sundararajan et al., 2017) as the second method to rank the features.

Original: Based on this procedure, we can generate an importance score for each feature given a trained network, and these scores are represented in Figure 4 for our model.
Revised: Based on this procedure, we can generate an importance score for each feature given a trained network, and these scores are represented in Figure 4 for our model.

Original: In contrast to the Bayesian approach, this method also includes the signs of the feature scores.
Revised: In contrast to the Bayesian approach, this method also includes the signs of the feature scores.

Original: A positive attribution score means that a particular feature positively contributed to the final prediction of an attack being ransomware and a negative score indicates the feature was important for predicting non-ransomware attacks.
Revised: A positive attribution score means that a particular feature positively contributed to the ﬁnal prediction of an attack being ransomware and a negative score indicates the feature was important for predicting non-ransomware attacks.

Original: The magnitude of the attribution score signifies the strength of the contribution.
Revised: The magnitude of the attribution score signiﬁes the strength of the contribution.

Original: A feature which does not meaningfully contribute to the final output has a score of near zero.
Revised: A feature which does not meaningfully contribute to the ﬁnal output has a score of near zero.

Original: F P ROOF OF T HEOREM 3. 
Revised: F P ROOF OF T HEOREM 3.

Original: In this appendix, we provide the proof of Theorem 3.1.
Revised: In this appendix, we provide the proof of Theorem 3.1.

Original: Proof.
Revised: Proof.

Original: [Equation]
Revised: [Equation]

Original: given that q ( w, π ) =
Revised: given that q ( w, π ) =

Original: q ( w | π ) q ( π ) and p ( w, π ) = 
Revised: q ( w | π ) q ( π ) and p ( w, π ) = p ( w | π ) p ( π ) [Equation] π

Revised: [Equation]

Original: p ( w | π ) p (  π )
Revised: & w log q ( w, π )

Original: [Equation]
Revised: [Equation]

Original: given that 
Revised: given that q ( π ) = Bern ( λ q ) and p ( π ) = Bern ( λ p ) [Equation]

Revised: [Equation]

Revised: λ

Original: [Equation]
Revised: [Equation]

Revised: ( λ p ))

Revised: [Equation]

Revised: λ q KL

Revised: [Equation]

Revised: p )

Revised: [Equation]