This dataset directory contains the samples and the models trained and tested in this article. It contains four subdirectories:

	- samples/: The samples used for training and testing all the models in the article.
		+ ransomwareSamples_train: The ransomware samples (for each binary) once the inactive ones were removed (32 hours).
		+ ransomwareSamples_test: All ransomware samples for each binary. Including those gathered when the ransomware was still not started or was already finished the encryption (122 hours).
		+ userSamples: All user samples splitted by day (0 to 6). The 'day0' samples were used for training the models (except for the case of training day comparison)
	- scaler.scaler: The StandardScaler object use for normalizing the sample values.
	- NN_CNN_LSTM_Comparison/: NN, CNN and LSTM model generated and compared in Section 3.3 of the article. These models were trained with all ransomware samples and the 'day0' users' traffic trace.
	- directoryGeneration/: Software for generating the shared directory used in the article. It contains the configuration files for generating the 'Standard1', 'Standard2', 'Large files' and 'Small files' directories. The name of the configuration files is: inputfile_[directoryName].
	- chronologicalModel/: It contains the models generated for the chronological evaluation.
	- MODEL-ALT/: It contains the models generated for the comparison between training with different day of not-infected traffic.
	- directories/: It contains the four directories used for running the ransomware binaries. Each directory can be created running the impressions program in directoryGeneration/ with its configuration file (inputfile_Standard1, inputfile_Standard2, inputfile_LargeFiles, inputfile_SmallFiles).

The files containing samples are structured as follows:

	- Each line is one sample.
	- Each sample has 30 features, the label (1 if it is 'infected' sample and 0 if it is not) and the timestamp of the last sample interval in the trace (in seconds since the beginning of the trace).
	- The features are separated by ',' because it is a csv file.
	- The values are not normalized, but the StandardScaler object use for doing it is in the file scaler.scaler

The models can be loaded in a python script using keras. Some important considerations about them are explained in the following lines.

Neural Network model (NN)
	The Neural Network model is composed by three hidden layers with 512, 256 and 128 cells. The input layer has 30 cells, and the output one has only 1 (binary classification).
	The complete information about its structure is in NN.json, in the main repository's directory. The file was obtained by the command to_json() from the keras model.

Convolutional Neural Network model (CNN)
	The Convolutional Neural Network model is composed by two convolutiona layers followed by two pooling layers and the last one unit dense layer for classify the binary sample.
	The complete information about its structure is in CNN.json, in the main repository's directory. The file was obtained by the command to_json() from the keras model.

Long Short Term Memory models (LSTM)
	ALl the Long Short Term Memory models compiled in this article has the same structure. They have the input layer and an additional hidden one, followed by the output layer that has only one cell.

As in previous cases, the complete information is in LSTM.json, in the main repository's directory. The file was obtained by the command to_json() from the keras model.

General considerations
	In a prediction, each model gets a value between 0 and 1, instead of getting a binary output. Due to our classification problem is binary (two classes), we should set a threshold for the classifier output. After some experiments we considered that the best option is set the threshold to 0.99, because the false positives are much more problematic than the false negatives. All the experiments performed in the article has been performed with this threshold.
