Zoubida Hammadi

Nadine Candoni

Romain Grossier

Manuel Ildefonso

Roger Morin

Stéphane Veesler
email: veesler@cinam.univ-mrs.fr

Crystal growth / Croissance cristalline Small-volume nucleation Vers le confinement spatial de la nucléation

Keywords:

The nucleation mechanisms behind crystallized products remain mysterious. In this communication, we describe experiments performed using small volumes, microdroplets, to control nucleation and thus product properties. The effect of small-volume systems on nucleation is discussed.

Introduction

It is now well established that the nucleation step is decisive in the control of the properties of crystallized products (pharmaceuticals, biominerals, nanomaterials). However, there is still no comprehensive theory of crystal nucleation from solution, mainly due to the fact that nucleation is of a stochastic nature: we do not know where and when an indefinite number of nucleation events will occur.

In this communication, we describe experiments we have performed using small volumes, microdroplets, to control nucleation. Microdroplets make observation at the micrometer scale, thus increasing the resolution of detection with an optical microscope, for instance. Microdroplets are also relevant in nucleation studies because they allow a large sample of independent experiments: for instance, 100 identical experiments in 10 nL will yield enough data for statistical analysis of the phenomenon, as compared to 1 experiment in 1 μL. Moreover, a study will require less solute. Our objective being to prove the relevance of small volumes for nucleation studies, we conducted experiments with biological, organic and mineral molecules, all of which follow the same rules [START_REF] Chernov | Crystal growth science between the centuries[END_REF] concerning crystallization even though each material exhibits specific characteristics.

Two important questions will be addressed here: how can microdroplets be generated and how does volume influence nucleation? We first present a microfluidic approach to generating droplets in order to measure nucleation frequency. Second, via an original approach using confined systems, i.e. small-volume systems whose volume affects nucleation [START_REF] Grossier | Reaching one single and stable critical cluster through finite sized systems[END_REF], we show a spatial and temporal control of nucleation.

Materials

Generation of microdroplets -Set-ups

Microfluidic devices

We used microfluidic devices in poly(dimethylsiloxane) (PDMS) and polyether ether ketone (PEEK)/Teflon (Figs. 1(a)-1(b)) designed in 2 parts: a plug-factory zone for the mixing and generation of droplets, without surfactant, made of PDMS or composed of a T-junction in PEEK (IDEX P-727 PEEK Tee) and a droplet-storage zone made of PDMS or composed of Teflon tubing (SCI, BB311-24) for the storage and observation of droplets. Droplets were generated at the intersection between the flow of the continuous phase and the liquid of interest. Precision syringe pumps (Bioseb BS-8000 or Nemesys NEM-B101-02) were used to control the flow rates (100-600 μL/h) of droplets and continuous phase. The channel size of the plug-factory, here 500 μm and 584 μm for PDMS and Teflon respectively, determines droplet size (250 nL). Using this set-up, we generated droplets (∼150) of identical volume at a given concentration and we filled storage chips that were stored at different temperatures. During generation and storage, the devices and the feeding syringes were thermostatted. Droplets were observed under a stereomicroscope (Wild Makroskop) equipped with a CCD camera (imaging source, DFK 31BF03).

Nanofluidics for volume confinement

We used a simply-constructed and easy-to-use fluidic device that generates arrayed aqueous phase microdroplets in oil [START_REF] Grossier | Generating nanoliter to femtoliter microdroplets with ease[END_REF] (Figs. 2(a)-2(b)). Up to thousands of microdroplets are generated, with volumes ranging from nanoliter to femtoliter, without surfactant. The device enables the entire volume range to be attained in the course of one experiment. All experiments are performed on an 18 mm diameter hydrophobic coverslip, which can be thermostatted, under an optical microscope. The coverslip is covered with approximately 100 μL of oil. The micrometer-sized droplets of water solution are generated on the coverslip by a microinjector (Femtojet Eppendorf) with a micropipette of 0.5 μm internal diameter (Femtotip Eppendorf). Two home-made micromanipulators (MS30 Mechonics) consisting of 3 miniature translation stages allow displacement of the injector (capillary holder) and the tip in X , Y and Z . Here, we made the sharp tips from tungsten (W) wires (125 μm diameter); for a detailed description see [START_REF] Muller | Field Ion Microscopy: Principles and Applications[END_REF][START_REF] Hammadi | Microelectron gun integrating a point-source cathode[END_REF][START_REF] Hammadi | Protein crystallization induced by a localized voltage[END_REF].

Multiwell for milliliter crystallization

The apparatus used here is home-made [START_REF] Detoisien | A rapid method for screening crystallization conditions and phases of an active pharmaceutical ingredient[END_REF] (since marketed by ANACRISMAT). 3 types of vials can be used; here, we used standard HPLC glass vials with 1 mL and 250 μL of solvent. The vials are inserted into two blocks (for 1 mL and 250 μL vials, each block contains 12 and 24 vials respectively) thermostatted independently by Peltier elements and observed under microscope (Nikon Eclipse TE2000-U). The whole assembly is mounted on an X -Y translation table with a Z -control to focus. Sequential image acquisitions are performed automatically and periodically.

Solutes

Protein solutions

Hen-egg white lysozyme (14 600 Da, pI = 11.2) was purchased from Sigma (batch 057K7013 L 2879) and used without further purification. BPTI (6511 Da, pI = 10.5), was supplied as a lyophilized powder by Bayer and used as received. The purity of both proteins was checked by molecular sieving. Proper amounts of BPTI or lysozyme and NaCl were dissolved in pure water (ELGA UHQ reverse osmosis system) to obtain stock solutions needed for crystallization experiments. The different solutions were buffered with 80 mM acetic acid, adjusted to pH = 4.5 with NaOH (1 M) and filtered through 0.22 μm Millipore filters. The pH was checked with a pH meter (Schott Instruments, ProLab 1000) equipped with a pH microelectrode. Lysozyme and BPTI concentrations were checked by optical density measurements (Biochrom, Libra S22) using an extinction coefficient of 2.64 mL cm -1 mg -1 and 0.786 mL cm -1 mg -1 [START_REF] Lafont | Solubility and prenucleation of aprotinin BPTI molecules in sodium chloride solution[END_REF] at 280 nm for lysozyme and BPTI, respectively.

Organic solutions

Caffeine was purchased from Sigma (batch A0283756) and used without further purification. Isonicotinamide was purchased from Sigma (batch BCBD6627) and used without further purification. A suitable amount of caffeine and isonicotinamide was dissolved in ethanol 99% (batch V0D770190D) to obtain the stock solutions required.

Oils

Mineral solutions

KNO 3 (R.P. Normapur, analytical reagent) solutions were prepared by dissolution of the proper amount of powder in pure water.

Results and discussion

Microfluidic crystallization

High-throughput approach, i.e. "automation, miniaturization and parallelization of tasks" [START_REF] Stevens | High-throughput protein crystallization[END_REF], was developed in order to rapidly identify crystallization conditions by increasing the number of experiments that can be performed in a given time, while decreasing the quantity of solute used. Microfluidic methods have already proved compatible with this approach, generating droplets of controlled size [START_REF] Anna | Formation of dispersions using "flow focusing" in microchannels[END_REF][START_REF] Laval | A microfluidic device for investigating crystal nucleation kinetics[END_REF], and is also valuable for the control and the study of crystallization processes [START_REF] Li | Nanoliter microfluidic hybrid method for simultaneous screening and optimization validated with crystallization of membrane proteins[END_REF][START_REF] Shim | Using microfluidics to decouple nucleation and growth of protein[END_REF][START_REF] Squires | Microfluidics: Fluid physics at the nanoliter scale[END_REF][START_REF] Leng | Microfluidic crystallization[END_REF][START_REF] Dombrowski | Crystallization of alpha-lactose monohydrate in a drop-based microfluidic crystallizer[END_REF][START_REF] Salmon | Microfluidics for kinetic inspection of phase diagrams[END_REF]. We recently developed a universally solvent-compatible microfluidic device for crystallization studies [START_REF] Ildefonso | Easy microfluidic crystallization device ensuring universal solvent compatibility[END_REF]. Theoretically, this PEEK/Teflon microfluidic device, adapted from a PDMS device developed by Laval et al. [START_REF] Laval | A microfluidic device for investigating crystal nucleation kinetics[END_REF], is ideal for studying This communication describes one application of the device: the determination of the metastable zone limit (MZ limit). The metastable zone represents a kinetic limit in the supersaturated region of the phase diagram below which no nucleation occurs for a given time in a given volume. It is thus of interest in the control of the crystallization process. Figs. 3(a)-3(d) show the MZ limit and crystals of lysozyme in aqueous solution and caffeine in ethanol determined using microfluidic devices. In these experiments, supersaturation is achieved by decrease of temperature.

We also focus on nucleation frequency, which depends on volume: the smaller the volume, the longer the induction time, thus requiring greater supersaturation for nucleation, namely a kinetic effect. Small volumes thus increase the supersaturation range experimentally accessible [START_REF] Ildefonso | Using microfluidics for fast, accurate measurement of lysozyme nucleation kinetics[END_REF]. However, they can be a limitation for a given solute-solvent, depending on the way supersaturation is achieved. As a result, here we were unable to detect any significant nucleation in 250 nL microfluidic crystallizers for isonicotinamide in ethanol, in the supersaturation range accessible with our set-up. Supersaturation is generated by first dissolving the solute at high temperature and then once the desired quantity is dissolved, decreasing temperature, as indicated by an arrow in Fig. 3(e). The highest temperature attainable with our set-up is 60 • C, thus the maximum concentration inside the syringe is 200 mg/mL (for larger concentrations there is a risk of unwanted nucleation inside the syringe before droplet generation). To confirm that induction time is inversely proportional to nucleation volume, we perform experiments on larger volumes, 1 mL and 250 μL, using a multiwell set-up. Results are shown in Figs. 3(e) and 3(f): a decrease of 6.5 • C in the MZ limit is observed when the volume decreases from 1 mL to 250 μL (volume divided by 4). Consequently, for a volume of 250 nL (volume divided by 10 3 ), the MZ limit is in the negative range of temperature, explaining the absence of nucleation of isonicotinamide in ethanol in our microfluidic device.

To overcome this problem, we propose two solutions: (1) changing the way supersaturation is achieved; or (2) using an external field. In the microfluidic device used in this study, temperature is usually used to achieve supersaturation, but another simple solution can easily be implemented: mixing different solutions, for instance a protein with an agent of crystallization or a solvent acting as an antisolvent, in order to rapidly reach the supersaturated stage. A T-junction can be added before the plug-factory zone to mix solutions. For instance, highly-supersaturated lysozyme solutions are generated by mixing a NaCl solution with a lysozyme solution in a buffer.

External fields to launch nucleation were previously tested successfully in batch crystallizers in the milliliter range [START_REF] Revalor | Usual and unusual crystallization from solution[END_REF]. An application of this approach in small volumes is presented in Section 3.2.

Influence of volume on nucleation

Theoretical considerations

The classical nucleation theory (CNT) supposes an infinite reservoir of molecules, in other words concentration and supersaturation remain constant during the nucleation event. When volume is decreased, the total number of molecules of the system is decreased and the reservoir of molecules becomes finite, in contradiction to the CNT. A simple way to illustrate this influence is to express the supersaturation as it is really experienced during the nucleation process, which consists of the addition of molecules to the forming cluster:

β(n) = β 0 - n N s ( 1
)
with N s the number of molecules a droplet has at saturation (size of the system), n the number of molecules in the forming cluster, β 0 and β(n) initial and current supersaturations. Replacing n by n * , the number of molecules in the critical nucleus, we obtain the supersaturation, β(n * ), at the moment of formation of the critical nucleus, that is to say at the moment of the nucleation of the first crystal.

In infinite volume, when N s → ∞; β(n * ) = β 0 , thus the CNT is verified. When volume is decreased, N s becomes finite and β(n * ) < β 0 , thus increasing the critical size and the energy barrier that need to be reached. In other words, the smaller the crystallization volume the more difficult the nucleation. As a result, in these small-volume systems unexpected high-supersaturated metastable solutions are observed. In practice, there is an influence of volume on nucleation from picoliter range down [START_REF] Grossier | Reaching one single and stable critical cluster through finite sized systems[END_REF]. This is in agreement with experimental results showing effects under nanoscopic confinement [START_REF] Ha | Polymorph selectivity under nanoscopic confinement[END_REF][START_REF] Beiner | Manipulating the crystalline state of pharmaceuticals by nanoconfinement[END_REF][START_REF] Kim | Formation of nanosized organic molecular crystals on engineered surfaces[END_REF][START_REF] Stephens | Amorphous calcium carbonate is stabilized in confinement[END_REF][START_REF] Grossier | Ultra-fast crystallization due to confinement[END_REF].

To summarize, nucleation experiments conducted with microfluidic set-ups in the nanoliter range are in agreement with the CNT, meaning that they are representative of nucleation in infinite volume, apart from a kinetic effect (the smaller the volume, the longer the induction time). Whereas nucleation experiments conducted with our nanofluidic set-up in the nanoliter to femtoliters range are subject to an added thermodynamic effect that stabilizes high-supersaturated solutions.

Practical applications

We conducted two sets of nucleation experiments in small volumes, one by evaporation and the other launched by a mechanical contact using a tip.

In the first, after generating droplets of 1.9 M KNO 3 in water, we monitored the diffusion of water into the oil leading to increasing KNO 3 concentration until nucleation (Figs. 4(a)-4(d)) and both nucleation events are single. Interestingly, single crystals nucleated were rough and a transition from growth form to equilibrium form was observed in less than 3 minutes (Figs. 4(c)-4(f)). The supersaturation at the moment of nucleation is high and can be conservatively estimated from the decrease in droplet volumes between Figs. 4(a) and 4(b), making the simple assumption that concentration remains constant between Figs. 4(b) and 4(c). Droplet diameter decreases from 15 to 9.3 μm, thus volume decreases by a factor of 0.238. The concentration is thus 1.9/0.238 = 7.98 M, a value larger than that obtained (7.07 M) by Laval et al. [START_REF] Laval | Microfluidic screening of potassium nitrate polymorphism[END_REF] in their experiments on KNO 3 nucleation by temperature variation in 100 nL microfluidic droplets.

Moreover, the fact that the crystal shape is rough hints at the shape of the critical nucleus. In the CNT, the shape of the critical nucleus is approximated by a sphere in order to simplify the excess term in the computation of the Gibbs free energy. An averaged interfacial energy, γ , is used in the computation as a consequence of the isotropic assumption on the critical nucleus shape. The crystal observed in Fig. 4(c) is in good agreement with this isotropic assumption, instead of presenting a faceted critical nucleus.

In the second set of experiments: first, we generated a high-supersaturated droplet of BPTI with the microinjector (Figs. 5(a)-5(d)) in order to stabilize it (with respect to nucleation) by volume confinement. Second, we used a sharp tip to induce a single nucleation event by touching the supersaturated metastable droplet of BPTI solution (Fig. 5(f)). We induced a structural transformation via mechanical contact at precisely determined points and times. This is in agreement with previous results obtained by Lenhoff group [START_REF] Vivares | Quantitative imaging by confocal scanning fluorescence microscopy of protein crystallization via liquid-liquid phase separation[END_REF] in which as soon as a crystal touches the surface of a protein-rich droplet, obtained by liquid-liquid phase separation, crystals instantaneously nucleate and grow. This seems to be a general rule: any disturbance triggers nucleation once a highly-supersaturated metastable state has been achieved.

Conclusions

In this communication, we present the use of small volumes, microdroplets, to control nucleation, conducting experiments with biological, organic and mineral molecules.

We use both microfluidic thermostatted devices allowing droplets to be formed in different aqueous and organic solvents and stored for several weeks without significant evaporation and a fluidic device that generates arrayed aqueous phase microdroplets in oil, with volumes ranging from nanoliter to femtoliter, without surfactant. We show that our microfluidic devices make it possible to study nucleation in both aqueous and organic solvents, and are applicable to organic molecules such as APIs, explosives or metal oxide nanoparticles.

For nucleation experiments conducted with the microfluidic set-ups, volume does not affect the nucleation process, which means they are representative of nucleation in infinite volumes, apart from a kinetic effect. However, nucleation experiments conducted in smaller volumes with our fluidic device are subject to an added thermodynamic effect, due to confinement, that stabilizes high-supersaturated solutions.

Lastly, we show, using a sharp tip (acting as a "magic wand") that a single nucleation event is launched as soon as the tip touches the supersaturated confined metastable solution. This spatial and temporal control is a major step forward in understanding the factors influencing the nucleation process.

Fig. 1 .

 1 Fig. 1. (a) PDMS microfluidic device, (1) plug-factory and (2) droplet-storage zone, and (b) PEEK/Teflon microfluidic device, (1) syringe pumps, (2) temperature controller (room T to 60 • C) and (3) T-junction.

Fig. 2 .

 2 Fig. 2. (a) Image of the whole experimental nanofluidic set-up, (1) microscope, (2) glass micropipette, (3) X Y Z miniature translation stages for injector and (4) sharp tungsten tip, and (b) array of monodisperse water droplets (11.8 μm or 0.7 pL).

  Dodecanemethylpentasiloxane (DMS) oil (Hampton Research HR2-593, refractive index = 1.390 at 20 • C) and Fluorinert™ FC-70 oil (Hampton Research HR2-797, refractive index = 1.303 at 20 • C) were used as continuous phases.

Fig. 3 .

 3 Fig. 3. Solubility and MZ limit, (a) lysozyme in NaCl 0.7 M and pH = 4.5 (device in PDMS), (c) caffeine in ethanol (device in PEEK/Teflon) after [18] with permission of ACS and (e) isonicotinamide in ethanol (multiwell of 1 mL and 250 μL). (b) Lysozyme crystals in aqueous droplets, (d) caffeine crystals in ethanol droplet and (f) crystal of isonicotinamide in ethanol. For experimental procedures see Refs. [7,18,21].

Fig. 4 .

 4 Fig. 4. Nucleation and growth of KNO 3 (1.9 M) in H 2 O in FC-70 oil, (a) droplet size 15 μm (2 pL) at t = 0, (b) droplet size 9.3 μm (0.48 pL), t = 8 min 29 s, (c) t = 9 min 15 s, (d) t = 9 min 17 s, (e) t = 10 min 18 s and (f) t = 12 min 12 s.

Fig. 5 .

 5 Fig. 5. ((a) to (d)) Generation of a BPTI droplet (20 mg/mL) in NaCl (1.6 M) in DMS oil and nucleation and growth of BPTI, (e) droplet size 85 μm (200 pL) at t = 0, (f) t = 30 min, (g) t = 80 min and (h) t = 130 min.

Acknowledgements

We thank N. Ferté for protein characterization and fruitful discussions and Minh Phat La for technical assistance. We thank M. Sweetko for revising English.


M Alwan

N Candoni

Ph Dumas

H R Klein
email: klein@cinam.univ-mrs.fr

Statistical evidence of strain induced breaking of metallic point contacts

Keywords: 73, 63, Rt electronic transport in nanocontacts -81, 07, Lk fabrication of nanocontacts

A Scanning Tunneling Microscopy in Break Junction regime and a Mechanically Controllable Break Junction are used to acquire thousands of conductance-elongation curves by stretching until breaking and re-connecting Au junctions. From a robust statistical analysis performed on large sets of experiments , parameters such as lifetime, elongation and occurrence probabilities are extracted. The analysis of results obtained for different stretching speeds of the electrodes indicates that the breaking mechanism of di-and mono-atomic junction is identical, and that the junctions undergo atomic rearrangement during their stretching and at the moment of breaking.

Introduction

During the last decades, electronic properties of atomic sized metallic contacts have interested several groups employing different techniques [START_REF] Agraït | Quantum properties of atomic-sized conductors[END_REF]. First studies were carried out using Scanning Tunneling Microscopy in Break junction regime (STM-BJ) [START_REF] Gimzewski | Transition from the tunneling regime to point contact studied using scanning tunneling microscopy[END_REF]. The second most used technique is the Mechanically Controllable Break Junction (MCBJ) developed by Muller et al. [START_REF] Muller | Conductance and supercurrent discontinuities in atomic-scale metallic constrictions of variable width[END_REF] in 1992 and based on an earlier design by Moreland and Ekin. [START_REF] Moreland | Electron tunneling experiments using nb-sn "break" junctions[END_REF] Both STM-BJ and MCBJ techniques are based on the stretching of an Au wire. During stretching, the Au wire gets thinner, and finally breaks leading to two electrodes. Before breaking, at a given bias voltage, the current flowing through the junction is measured as a function of the relative elongation of Au wire. As it is expected in diffusive regime, the current first decreases linearly while the elongation of the wire. However, in the ultimate stage before breaking, while the diameter of the Au wire consists only in a few atoms, the electronic transport becomes ballistic with the conductance given by:

G = 2e 2 h N n=1
T n

Where N is the number of available channels for the electrons in the junction, e the electron charge, h the Planck's constant and T n the transmission probability of the channels. In junctions of atomic dimensions, conduction channels are directly related to wave functions of the metal [START_REF] Scheer | The signature of chemical valence in the electrical conduction through a single atom contact[END_REF]. In the particular case of gold, the conductance of a single atom-junction is due to one conductance channel with transmission probability close to unity [START_REF] Vega | Different wavelength oscillations in the conductance of 5d metal atomic chains[END_REF]. Thus, its conductance is close to 2e 2 /h, the conductance quantum G 0 .

Therefore, in MCBJ or STM-BJ experiments, a gold monoatomic junction is characterized by a constant conductance of 1G 0 during the stetching of the junction, i.e. a ballistic plateau at 1G 0 . It is noteworthy that the length of this plateau gives a direct access to the lifetime of the mono-atomic junction. Similarly, the ballistic plateau observed at 2G 0 is distinctive of a junction containing two atoms in its section.

Such junctions are often employed to bind molecules displaying terminations with a high affinity to metals such as thiols or amino groups [START_REF] Chen | Measurement of single-molecule conductance[END_REF]. In this purpose, the mono-atomic junction is stretched until it breaks, leading to two Au nano electrodes. Then in the presence of molecules, these ones can graft on the electrodes and the conductance of the Au-molecule-Au junction are measured, giving access to single molecule conductance [START_REF] Leoni | Tools for conductance measurements of metallic and molecular nanowires[END_REF]. However such studies require stabilizing junctions for a period as long as possible. Thus, the understanding of the Au junction stability and breaking mechanism is crucial.

Tsutsui et al have studied the dependence of the lifetime of monoatomic gold contacts on the stretching speed of the electrodes [START_REF] Tsutsui | Formation and self-breaking mechanism of stable atom-sized junctions[END_REF]. They showed that for stretching speed higher than 1nm.s -1 , lifetime is limited by the strain applied to the junction. Similar results were obtained for molecular junction by Huang et al [START_REF] Huang | Single molecule junctions formed via au thiol contact: Stability and breakdown mechanism[END_REF]. For lower stretching speed, lifetime is rather limited by thermal motion, leading to discrete conductance fluctuations depending on the temperature of the experiment [START_REF] Klein | Conductance fluctuations in gold point contacts: an atomistic picture[END_REF].

Literature generally focuses on the ultimate ballistic plateau at 1G 0 , whereas the properties of the junction may depend on its earlier configuration. Therefore, in this work we explore as much ballistic plateaus at 1G 0 as at 2G 0 . Our study concerns the behavior of mono-and di-atomic junctions associated to 1 and 2G 0 conductances, respectively, at different stretching speeds in ambient conditions. Our specificity is the comparison of results obtained with two complementary techniques STM- BJ and MCBJ, developed in the laboratory, in order to avoid artifacts in these delicate measurements.

A great deal of effort is made in this paper to investigate experimental results through an objective statistical approach in order to highlight geometry and mechanical properties of Au junction. This is made possible by the ability to repeat the atomic contact experiments thousands of times using break junction setups (MCBJ or STM-BJ).

Experiments

Set-up

In STM-BJ, Au junctions are obtained by indenting an Au surface with a gold tip. Surfaces are prepared by electron beam evaporation under ultra high vacuum conditions of a 100nm layer of Au with a preferential [111] orientation [START_REF] Klein | Self-assembled monolayers of decanethiol on au(111)/mica[END_REF], while gold tips are electrochemically etched from 0.25 mm gold wire (99.99%, Goodfellow).

In our home-made MCBJ (sketched in figure 1), a thin Au wire (diameter 250µm) is glued onto a phosphorous bronze bending beam with two droplets of epoxy (Stycast 2850FT, curing agent 24LV). The basic principle consists in stretching the wire by bending the substrate with a mechanical actuator, until the junction breaks and gives two separate electrodes. Relaxing the force on the elastic substrate by back-bending allows the junction to be closed again. The mechanical actuator is composed of a stepping motor and a piezoelectric transducer (PZT) in series, which permits to control the process by ramping the zpiezovoltage. Because the wire is fixed, the vertical movement of the PZT is demagnified, allowing accurate control of wire stretching (elongation). The relative elongation can reach a resolution in the range of 5 picometers. Moreover, the MCBJ exhibits an outstanding mechanical stability (<5pm/s drift of the electrodes after breaking at room temperature for our setup). This stability results from the reduction of the mechanical loop which connects one electrode to the other, from centimeters, in the case of an STM scanner, to approximatively 0.2 mm in our MCBJ. The drawback is that the demagnification factor depends on the geometrical parameters of the sample, mainly on the distance between the glue droplets. It is thus difficult to obtain an absolute calibration of the relative displacement of the electrodes. An accurate calibration method using the Gundlach oscillations in the tunnel current has been proposed by Kolesnychenko et al [START_REF] Yu | Calibration of the distance between electrodes of mechanically controlled break junctions using field emission resonance[END_REF]. Unfortunately this method is not suitable for operation in ambient conditions. To circumvent this potential calibration issue, we have combined the MCBJ measurements with STM-BJ ones, where displacements are easily calibrated.

For the two setups, experiments are carried out in air using a bias voltage of the electrodes of 130 mV. The current is measured using a DLPCA-200 I/V converter (Femmto Messtechnik). Conductance versus elongation traces are recorded using a dedicated software described in detail elsewhere [START_REF] Leoni | Are conductance plateaus independent events in atomic point contact measurements? a statistical approach[END_REF]. Briefly, while the MCBJ or STM-BJ regulation loop is maintained off, the two electrodes are brought into contact prior to breaking off the junction by pulling the electrodes away with variable stretching speeds. Conductance data are simultaneously acquired at a sampling frequency of 10 kHz. The regulation loop is then activated for approximatively 1s and the cycle is repeated automatically thousands of times.

Methods

The recorded curves show ballistic plateaus in the transition between contact and vacuum tunneling. The quantization of conductance appears at approximately integer multiples of the Landauer conductance quantum,G 0 = 2e 2 /h as expected. However, some plateaus in the conductance curves cannot be unambiguously identified to integer multiples of the conductance quantum, nG 0 . In an attempt for an objective analysis of the data, we identify conductance plateaus by the abrupt changes of conductance, which separate them. The plateaus shorter than three consecutive acquisition points (0.2 ms) are discarded. From the acquisition of thousands of individual conductance curves of the same junction, histograms of conductance values are constructed, as shown on figure 2, More advanced statistics are performed after acquisition. The algorithms developed for these tasks are described elsewhere [START_REF] Leoni | Are conductance plateaus independent events in atomic point contact measurements? a statistical approach[END_REF]. They allow the extraction of occurences, average conductances and lifetimes of conductance plateaus. The same algorithms are used to analyse STM-BJ and MCBJ experiments.

Results and discussion

We have tested , using STM-BJ and MCBJ, stretching speeds of the electrodes in the range from 0.5 to 1000 nm.s -1 . In the recorded conductance-elongation curve, we focus on plateaus G 0 2G 0 Fig. 3. Histogram of lifetimes of G0 and 2G0 plateaus recorded using the MCBJ at a stretching speed of 142 nm.s -1 (bias 130 mV). Both histograms are obtained from sets of 75000 elongation curves, and can be described as an exponential decay law with similar time constants. STM-BJ experiments exhibit a similar behaviour.

at 1G 0 ( 0.8G 0 < G < 1.2G 0 ) and 2G 0 ( 1.6G 0 < G < 2.4G 0 ), which are attributed to mono-and di-atomic sections of the junction, respectively.

Lifetimes of mono-and di-atomic junctions

As conductance measurement is acquired at a constant stretching speed, the elongation of the contacts leading to ballistic plateaus at 1G 0 and 2G 0 is directly proportionnal to junctions' lifetime, reflecting their stability. From sets of thousands conductance curves, we can plot histograms of lifetimes of monoand di-atomic junction lifetimes. As shown in figure 3, the occurrence of plateaus lifetime typically leads to an exponential decay law given by the general expression

p(t) = exp(-t/τ ) τ
where τ corresponds to the mean value of lifetime. This exponential decrease is a clear indication of the random nature of the breaking process, as we have already reported in [START_REF] Leoni | Are conductance plateaus independent events in atomic point contact measurements? a statistical approach[END_REF]. Without any further investigations, this random process suggests that mono-and di-atomic junctions' breaking are driven either by thermal motion, by a random external perturbations or by the constraint applied to the junction, which would provide the system enough energy to break. The dependence of the lifetime of ballistic plateaus at 1 and 2 G 0 (τ 1 and τ 2 respectively) on the stretching speed shown in figure 4,indicate that the breaking is due to the strain applied to the junction. Indeed the strain increase with the stretching speed, and thus the lifetime decreases. Noteworthy, τ 1 and τ 2 exhibits similar values, and the same dependence on the stretching speed.

This result is in excellent quantitative agreement with data for ballistic plateaus at 1 G 0 previously published by Tsustui [START_REF] Tsutsui | Formation and self-breaking mechanism of stable atom-sized junctions[END_REF] and Huang [START_REF] Huang | Single molecule junctions formed via au thiol contact: Stability and breakdown mechanism[END_REF], using an MCBJ and a STM-BJ respectively.

We can imagine that the junction breaks like a constrained rope, one strands (conduction channel) after the other at a given lengthening [START_REF] Rubio-Bollinger | Mechanical properties and formation mechanisms of a wire of single gold atoms[END_REF]. In such a scenario, a diatomic junction displays two parallel conduction channels for the electrons flowing trough the junction. One of these channels breaks under strain, leading to a mono-atomic junction. We would then expect τ 1 to be much shorter than τ 2 because the last channel has already been stretched in the di-atomic junction before it breaks. However, τ 1 and τ 2 show quite close values and the same dependence on v, suggesting that the breaking mechanism is not sequential, and has the same origin for mono-and di-atomic junctions. G 0 2G 0 Fig. 5. Plateaus occurence probabilities at 1 and 2 G0 vs stretching speed. These values are obtained from sets of 75000 conductance curves for each stretching speed using MCBJ and STM-BJ at a bias of 130mV. Increasing the stretching speed (and thus the strain applied to the junction), lead to a decrease of the occurence probabilities of conductance plateaus.

Occurence of mono-and di-atomic junctions

Our advanced statistical analysis allows extracting not only lifetimes but also occurence probabilities of ballistic plateaus at 1 and 2 G 0 , P 1 and P 2 respectively. The dependence of these probabilities on the stretching speed is shown on figure 5. This curve shows that the ocurences of ballistic plateaus dramatically decrease while the stretching speed (and thus the constraint) increases.

In addition, on figure 6, the dependence of the product of the probabilities P 1 .P 2 on P 1&2 , the joint probability to observe conductance plateaus at 1 and 2 G 0 on the same conductance curve, is plotted . These probabilities show very close values for all the stretching speed explored in this study with the STM-BJ and MCBJ setups. It points out that the occurences of ballistic plateaus are statistically independent events. In the case of sequential breaking of di-and mono-atomic junctions, plateaus at 1 and 2 G 0 must appear together in conductancetime curves leading to correlated occuring probabilities. The observed statistical independence means that the plateau at 1 G 0 exists wether the plateau at 2 G 0 exists or not, and viceversa, as shown by the combination of the probabilities P 1 and P 1&2 . Using these values we can calculate that 50% of the 1 G 0 events are subsequent to 2 G 0 events at the stretching speed of 142 nm.s -1 , to be compared to 23 % at 284 nm.s -1 and 60 % at 23.7 nm.s -1 for instance.

Consequently, the di-atomic junction is certainly not composed of two conduction channels in parallel, which would break sequentially. But rather a more complicated atomic structure implying a width of two atoms in its thinner part, as confirmed by tight-binding molecular dynamic [START_REF] Coura | On the structural and stability features of linear atomic suspended chains formed from gold nanowires stretching[END_REF][START_REF] Dreher | Structure and conductance histogram of atomic-sized au contacts[END_REF][START_REF] Leoni | Are conductance plateaus independent events in atomic point contact measurements? a statistical approach[END_REF]. These simulations show that the junction displays an asymetric structure during stretching, meaning that the strain applied to the atomic bonds is not homogeneous. Fig. 6. Product of the probabilities to observe a plateau at G0 (P1) times the probability to observe a plateau at 2G0 (P2) vs the joint probability P 1&2 to observe both plateaus during the same experiment. This graph gathers the results obtained from the STM-BJ and MCBJ experiments for the whole stretching speed range of the present study. Dashed line : P1.P2 = P 1&2

Breaking mechanism

During stretchnig, the junction stiffness increases with the accumulated elastic energy. Then, the only way to relax a part of this excess of energy is a plastic deformation, by the rupture of the most strained bond. This occurs for given elongations, independent of the stretching speed, 0.1-0.15 nm in our study. Several experimental studies at low temperature [START_REF] Yanson | Formation and manipulation of a metallic wire of single gold atoms[END_REF] and in ambient conditions [START_REF] Huang | Single molecule junctions formed via au thiol contact: Stability and breakdown mechanism[END_REF] reported an elongation at rupture of 0.1 to 0.25 nm corresponding to inter-atomic distance between gold atoms , in good agreement with molecular dynamics simulations. Thus, the junction has to be considered more as a contact than as a chain of atoms. G. Rubio-Bollinger estimated a rupture force of 1.5 ± 0.5 nN [START_REF] Rubio | Atomic-sized metallic contacts: Mechanical properties and electronic transport[END_REF]. By considering the junction as a spring, the ration between this force and elongation at rupture leads to a spring constant of 10-15 N.m -1 , and an energy release at rupture of 0.2-0.7 eV. Numerical simulations of junction breaking are in excellent agreement with experimental values [START_REF] Vélez | When do nanowires break? A model for the theoretical study of the long-term stability of monoatomic nanowires[END_REF].

Our study points out that similar results are obtained both for mono-and di-atomic junctions, indicating that their breaking mechanism is identical. As the junction undergoes plastic deformation, the corresponding energy release can lead either to atomic reconfiguration of the junction or to breaking of the remaining bonds. Hence the conductance elongation curve, after a 2 G 0 conductance plateau, will display either a rupture or a conductance plateau at 1 G 0 corresponding to a junction with a structure not correlated with the previous one. This fully explains the fact that 1 and 2 G 0 conductance plateaus are statistical independent events.

Conclusion

A MCBJ and a STM-BJ have been used to acquire thousands of conductance -elongation curves by stretching until breaking and re-connecting Au junctions. Data on ballistic plateaus at 1G 0 and 2G 0 are extracted and statistically analysed, in order to explain the breaking of mono-and di-atomic Au junctions in ambient conditions.

Our study relies on a robust statistical analysis performed on large sets of experiments. Moreover, it combines results obtained with two complementary techniques : STM-BJ and MCBJ. The excellent agreement between the results, strengthen the analysis and ensures the lack of artifacts in lifetime measurements related either to external perturbations (vibrations, thermal drift) in STM-BJ experiments, or calibration issues in MCBJ ones.

The dependence of the lifetime of gold junctions on the stretching speed of the electrodes showed that for stretching speed higher than 1nm.s -1 , lifetime is limited by the strain applied to the junction. This is in agreement with previously published works focusing on mono-atomic junctions. The present study extends this result to di-atomic junctions indicating that their breaking mechanism is identical. Moreover, the analysis of occurrence probabilities of the ballistic plateaus gives an experimental evidence that junctions undergo atomic rearrangement during their stretching and at the moment of breaking.

To our knowledge, it is the first time that a statistical approach provides such complementary informations on breaking mechanism of Au nano-junctions.

Fig. 1 .

 1 Fig. 1. Schematics of our home made MCBJ. Top : The basic principle consists in stretching the wire by bending the substrate with a mechanical actuator , until the junction breaks and gives two separate electrodes. Relaxing the force on the elastic substrate by back-bending allows the junction to be closed again. The mechanical actuator is composed of a stepping motor and a piezoelectric transducer (PZT) in series. Down : A thin Au wire (diameter 125µm) is glued onto a phosphorous bronze bending beam with two droplets of epoxy.

Fig. 2 .

 2 Fig. 2. Typical histogram of conductance constructed from a set of 9000 conductance vs elongation traces recorded using the STMBJ at a stretching speed of 142 nm.s -1 (bias 130 mV). Two conductance vs elongation traces are also shown. On these traces conductance plateaus are separated by abrupt changes of conductance marked by the dashed arrows.

Fig. 4 .

 4 Fig. 4. Lifetimes of ballistic plateaus at 1 and 2 G0vs stretching speed of the electrodes obtained with MCBJ (circles and squares) and STM-BJ (up and down triangles) at a bias of 130 mV. Values calculated from 75000 experiments. Horizontal error bars on MCBJ points represents the uncertainty in the calibration of the relative displacement of the electrodes.


Bruno L Sena

Guilherme C Paternezi

Rhian Bottura

Vinicius De

Carvalho Bastos

Orientadora : Drª

Marise Miranda

Dr Americo Talarico

Domingos Sanches

Keywords: AI-powered detection, Beyond WannaCry, Adaptable defense, WannaCry countermeasures Resumé

Cybersecurity threats like WannaCry are constantly evolving, leaving traditional defenses struggling to keep up. This research explores a powerful new weapon: Artificial Intelligence (AI). Using Bayesian Networks, a type of AI, we developed a method that detects WannaCry with 67.47% accuracy, outperforming traditional signature-based approaches. But this is just the beginning. Our AI model can learn and adapt, making it effective against even unknown malware, offering a crucial advantage in the ever-changing cybersecurity landscape.

Mais ce n'est que le début. Notre modèle d'IA peut apprendre et s'adapter, ce qui le rend efficace même contre les logiciels malveillants inconnus, offrant un avantage crucial dans le paysage de la cybersécurité en constante évolution.. Mots-clés : Détection basée sur l'IA, Au-delà de WannaCry, Défense adaptable, Contre-mesures WannaCry

Introdution

The WannaCry attack, a global ransomware that wreaked havoc in 2017, had a significant impact on various sectors and individuals.

This study explores the potential of AI technology for WannaCry detection. While interesting, it's crucial to acknowledge that relying solely on a technical solution might have limitations. These could include potential vulnerabilities, data privacy concerns, or the need for ongoing technical expertise for maintenance and updates.

A general viewpoint on the problem and the main consequences of the attack are the same, which include:

• Financial losses: It is estimated that the attack caused over $4 billion in financial losses for businesses and organizations worldwide.

• Service disruption: The attack disrupted essential services in various sectors, such as healthcare, transportation, and government. Hospitals, for example, were forced to cancel surgeries and redirect patients, while transportation companies had to suspend their services.

• Reputational damage: The attack damaged the reputation of affected businesses and organizations, leading to a loss of trust from customers and partners.

• Increased awareness of cybersecurity: The WannaCry attack served as a wake-up call for businesses and organizations about the importance of cybersecurity. This has led to increased investment in security measures to protect against future attacks.

The WannaCry attack highlighted the need for better protection against cyberattacks. Businesses and organizations must take steps to strengthen their cybersecurity, such as implementing appropriate security measures, educating their employees about cybersecurity, and having incident response plans in place.

By taking these steps, we can increase resilience against future cyberattacks and minimize their impact.

Some other consequences of the WannaCry attack:

• Increased demand for cybersecurity professionals.

• Development of new cybersecurity technologies.

• Increased international cooperation to combat cybercrime.

The WannaCry attack was a major event that had a significant impact on the digital world. The consequences of the attack are still being felt today, but it also served as a catalyst for positive changes around cybersecurity.

Artificial intelligence (AI) emerges as a powerful weapon in the battle against malware, offering an adaptive defense against evolving threats. WannaCry, a global ransomware attack that wreaked havoc in 2017, serves as an urgent reminder of the need for innovative cybersecurity solutions.

Some figures about the WannaCry attack:

• 200,000 computers infected in 150 countries.

• Over $4 billion in financial losses.

• Healthcare organizations, governments, and businesses were the main targets.

Traditional malware detection techniques, such as signature-based ones, were not effective against WannaCry. The attack exploited a vulnerability in the Windows operating system that had not been patched by many organizations.

AI presents a crucial opportunity to overcome the limitations of traditional approaches. AI techniques can learn from historical attack data, identify patterns, and predict new malicious behaviors.

This article explores how AI can be leveraged to combat malware, focusing on WannaCry and other Advanced Persistent Threats (APTs). We discuss the construction of AI models that can learn from historical attack data, identify patterns, and predict new malicious behaviors.

AI represents a quantum leap in cybersecurity, offering a proactive and adaptive defense against constantly mutating threats. By combining human intelligence with the power of AI, we can ensure a safer future in the digital world.

Sames examples of how AI can be used to combat WannaCry and other APTs:

• Network traffic analysis to identify malicious patterns.

• Anomaly detection in files and emails.

• Creating behavior models to identify suspicious activities.

AI is still under development, but it has the potential to revolutionize cybersecurity. By using AI, we can create smarter and more adaptable defenses that can protect organizations against evolving threats.

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) are solutions that automate various threat detection and mitigation processes in corporate networks (Silva, 2023). However, such solutions present inaccuracies that can compromise the availability of the systems they are implemented in, furthermore impairing the performance of security teams tasked with monitoring (MENEZES, 2022).

False positives:

• Fastly research:

According to research conducted by Fastly, an American cloud computing service provider, almost 45% of all security alerts are false positives (FASTLY, 2023).

• Ponemon Institute research:

Another research, conducted by the Ponemon Institute, points out that security teams spend about 25% of their total work time analyzing and investigating false positives [START_REF] Ponemon Institute | Estudo da Força de Trabalho de Segurança Cibernética de[END_REF].

Consequences:

• Alert fatigue:

This scenario leads to a phenomenon known as alert fatigue, which is a problem that occurs when cybersecurity professionals are inundated with such a high volume of security alerts that it leads teams to have a lower capacity for effective response and investigation of real threats (GARCIA, 2021).

• Service unavailability:

The excessive numbers of false positives can generate service unavailability caused by false detections of IPS systems, since they constantly take measures such as access blocks and service interruptions (ALVES, 2020).

Implementing measures to mitigate the risks of false positives in IDS/IPS is essential to ensure the security of the corporate network. The measures described in this article can help companies reduce the number of false positives, increase the efficiency of security teams, and protect their data from cyber-attacks, table 1.

Proposal for an Enhanced Threat Detection Model with Bayesian Networks to Increase Assertiveness in IDS/IPS Systems

Intrusion detection and prevention systems (IDS/IPS) represent a critical line of defense in protecting networks and systems against cyberattacks. However, the effectiveness of these systems can be compromised by several factors, such as the high rate of false positives and the constant evolution of attack techniques (Silva, 2023;[START_REF] Menezes | Proposta de um Modelo Híbrido de Detecção de Ameaças para Sistemas IDS/IPS[END_REF].

The methodology this project proposes an enhanced threat detection model that utilizes Bayesian Networks (BNs) and Bayes' Theorem to increase assertiveness in identifying malicious activities in IDS/IPS systems. The signature-based detection technique traditionally used by these systems presents limitations in detecting new malware variants and unknown attacks [START_REF] Zou | A Survey of Anomaly Detection in Cybersecurity[END_REF].

The proposed model relies on the ability of BNs to learn and represent probabilistic relationships between variables, allowing for inference and classification of new instances [START_REF] Pearl | Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference[END_REF]. Bayes' Theorem will be applied to calculate the conditional probability of an event being a threat, considering the observed characteristics of the system's behavior.

The model will be evaluated in two stages. In the first, it will be applied to a malware database from an Open Cyber Threat Intelligence platform, focusing on a single malware category. The goal is to identify indicators of compromise (IoCs) associated with the malware with a high conditional probability rate. In the second stage, the model will be applied to a database with different malware families to test its generalization capability and identify new malware variants.

The proposed model is expected to exhibit higher assertiveness than signature-based detection, with a lower false positive rate and a higher capacity to identify new threats. The evaluation of the results will allow for the validation of the proposal and the generation of conclusions about the feasibility and effectiveness of the model.

This project aims to contribute to the advancement of research in cybersecurity by proposing an innovative model for threat detection in IDS/IPS systems. The use of BNs and Bayes' Theorem offers a robust probabilistic framework for event classification and identification of malicious activities with a higher degree of accuracy.

Selection of Bayesian for WannaCry Detection

The selection of Bayesian for WannaCry detection was based on a literature review of Pattern Recognition and Machine Learning techniques. The choice of this technique over others, such as KNN (K-Nearest Neighbors) and the C4.5 algorithm, is due to its probabilistic nature and its ability to capture complex relationships between variables. These characteristics are commonly used in disease detection and diagnosis mechanisms, a scenario that shares similarities with the field of malware detection, as it deals with independent variables that may or may not interfere with the diagnosis obtained.

A

Possible reasons for the relatively low accuracy:

• Noisy data: The dataset may contain noisy or irrelevant data, which can make it difficult for the Machine Learning algorithm to learn the patterns that are characteristic of malware.

• Insufficient training data: The Machine Learning algorithm may not have been trained on a sufficiently large and diverse dataset. This can lead to overfitting, where the algorithm learns the specific details of the training data but is unable to generalize to new data.

• Inadequate feature selection: The API call 2-gram features may not be the most effective features for detecting malware. There may be other features that are more discriminative and would lead to higher classification accuracy. • Inappropriate Machine Learning algorithm: The Machine Learning algorithm used may not be the most suitable for the task of malware detection. There may be other algorithms that are more effective at learning the complex relationships between API calls and identifying patterns that are characteristic of malware.

Possible ways to improve the accuracy:

• Data preprocessing: The dataset can be preprocessed to remove noisy or irrelevant data. This can help the Machine Learning algorithm to learn the patterns that are characteristic of malware more effectively. • Data augmentation: The dataset can be augmented by generating new data points from the existing data.

This can help to improve the diversity of the dataset and reduce the risk of overfitting. • Feature selection: Different feature selection techniques can be used to select the most discriminative features for malware detection. This can help to improve the performance of the Machine Learning algorithm.

• Hyperparameter tuning: The hyperparameters of the Machine Learning algorithm can be tuned to optimize its performance. This can help to improve the classification accuracy of the algorithm.

By addressing these issues, it is possible to improve the accuracy of malware detection using API call 2-gram features.

More choose algorithms: Comparative classification accuracy based on features from PE32 header.

The table 3 below shows the comparative classification accuracy of different Machine Learning algorithms in detecting malware, based on features extracted from the PE32 header. The benign dataset (Bn) and two malware datasets (Ml 000 and Ml 207) were used for evaluation [START_REF] Shukurov | Comparative analysis of machine learning algorithms for malware detection based on PE header features[END_REF]. As can be seen from the table 3, Support Vector Machine achieved the highest classification accuracy of 95.00%. This indicates that SVM is the most effective algorithm for detecting malware based on PE32 header features.

It is important to note that the classification accuracy may vary depending on the specific dataset used and the parameters of the Machine Learning algorithm. However, the results presented in the table provide a general comparison of the performance of different algorithms in malware detection using PE32 header features.

PE32 header features, on definition [START_REF] Sharif | Comparative Study of Prognosis of Malware with PE Headers Based Machine Leaning Techniques[END_REF], are a set of attributes extracted from the Portable Executable (PE32) header of a Windows executable file. The PE32 header is a data structure that contains information about the file, such as its entry point, image base, and section headers. PE32 header features can be used for a variety of purposes, including malware detection, software analysis, and reverse engineering.

Some common PE32 header features include:

• Machine type: This field specifies the type of CPU that the executable is designed to run on.

• Number of sections: This field specifies the number of sections in the executable.

• Time stamp: This field specifies the date and time when the executable was compiled.

• Entry point: This field specifies the address of the function that is called when the executable is loaded into memory.

• Image base: This field specifies the address in memory where the executable is loaded.

• Section headers: These fields contain information about each section in the executable, such as its name, size, and permissions.

PE32 header features can be extracted using a variety of tools, including the Windows API, the PE File Format specification, and third-party libraries.

PE32 header features are often used for malware detection because they can provide information about the origin and behavior of an executable file. For example, the machine type field can be used to identify executables that are designed to run on a specific type of CPU, which can be helpful for detecting malware that is targeted at a particular platform. The time stamp field can be used to identify executables that were compiled recently, which can be helpful for detecting newly released malware.

PE32 header features can also be used for software analysis and reverse engineering. For example, the section headers can be used to identify the different parts of an executable file, such as the code section, the data section, and the resource section. This information can be helpful for understanding how the executable works and for making modifications to it.

Examples of accuracy tests with different algorithms

A study published in 2022, entitled " Malware Analysis and Detection Using Machine Learning Algorithms", [START_REF] Akhtar | Malware Analysis and Detection Using Machine Learning Algorithms[END_REF], compared the performance of different Machine Learning algorithms, including Naive Bayes, Bayesian Networks, SVM, and Random Forest, in malware detection. The results showed that the Random Forest algorithm presented the highest accuracy rate (98.7%), followed by SVM (97.5%), Naive Bayes (96.3%), and Bayesian Networks (95.1%), table 4. Another study, published in 2023, entitled "Evaluation of Machine Learning Algorithms for Malware Detection", [START_REF] Akhtar | Evaluation of Machine Learning Algorithms for Malware Detection[END_REF], evaluated the performance of Machine Learning algorithms, such as Decision Tree, k-NN and others, in malware detection on mobile devices. The results showed that the Decision Tree algorithm presented the highest accuracy rate (99.2%), followed by k-NN (98.9), both around 99 %, showed in figure 1. The figures show that the choice of Machine Learning algorithm can affect the accuracy rate of malware detection. However, it is important to emphasize that the accuracy rate may vary depending on the dataset used and the algorithm's parameters.

These studies demonstrate that the choice of Machine Learning algorithm can affect the accuracy rate of malware detection. However, it is important to emphasize that the accuracy rate may vary depending on the dataset used and the algorithm's parameters.

The objective of this article is to apply Bayesian Networks in the WannaCry malware detection process, obtain and analyze the results, and consequently, carry out a comparison with the work of other authors, in future works.

Bayes' Theorem

Bayes' theorem is a probability formula that calculates the probability of an event occurring, based on variables associated with that event and their respective conditional probabilities. Early research related to probability calculus that would later inspire the development of Bayes' theorem was conducted by the mathematician Thomas Bayes in the 18th century and recorded in an unpublished manuscript. This manuscript contained formulas for calculating statistical inference and was read, reproduced, and expanded by Richard Price. Price wrote an introduction to Bayes' paper, in which he established some of the essential concepts of Bayesian statistics. [START_REF] Pearl | Bayes' theorem[END_REF].

The theorem addresses conditional probability, which is concerned with determining the probability of an event A occurring given some prior knowledge about an event B, as shown in Figure 2. Mathematically, it can be expressed as follows:

Figure 2 -Formula General Bayes' Theorem. Source: Autor's compilation where:

• P(A|B) is the conditional probability of event A occurring given that event B has already occurred.

• P(B|A) is the conditional probability of event B occurring given that event A has already occurred.

• P(A) is the prior probability of event A occurring, without any knowledge of event B.

• P(B) is the prior probability of event B occurring, without any knowledge of event A.

Bayes' theorem is a powerful tool for updating probabilities in light of new evidence. It is used in a wide variety of applications, including:

• Machine learning: Bayes' theorem is used in machine learning algorithms to make predictions about new data. For example, a spam filter might use Bayes' theorem to calculate the probability that an email is spam, based on the words and phrases it contains.

• Medical diagnosis: Bayes' theorem is used in medical diagnosis to calculate the probability that a patient has a particular disease, based on their symptoms and test results.

• Quality control: Bayes' theorem is used in quality control to calculate the probability that a manufactured product is defective, based on the results of quality control tests.

Bayes' theorem is a fundamental theorem of probability theory and has a wide range of applications in many different fields.

Bayesian networks

Bayesian networks, also known as Bayesian graphs or belief networks, are a graphical representation of probabilistic models that describe the relationships among a set of variables in a Bayesian model. These networks are particularly useful for modeling and reasoning about uncertainty in complex systems, where multiple variables are interconnected in probabilistic ways.

The structure of a Bayesian network consists of two main elements:

• Nodes: Nodes represent the random variables in the system. Each node can represent a condition, an event, a decision, or anything else that can be quantified with probability. Nodes can be of two main types:

▪ Evidence nodes (or observed variables) are those whose values are known or observed.

▪ Latent nodes (or hidden variables) are those whose values are not directly observed and are inferred based on the evidence.

• Edges: Edges represent the probabilistic relationships between the nodes. They indicate the conditional dependence between the nodes connected by an edge. This means that a node can depend on other nodes that are directly connected to it.

In addition to the structure, Bayesian networks incorporate probabilities into their edges to quantify the nature of the dependencies between the nodes. These probabilities are specified using conditional probability tables (CPTs) that describe the probability of a node in question given the values of its parent nodes.

A Bayesian network is constructed in such a way that it satisfies the principle of Bayes' conditional independence. This means that the probability of a node depends only on the values of its parent nodes in the graph. The structure of Bayesian networks reflects causal relationships, allowing the networks to effectively represent domain expertise.

Reasoning in Bayesian networks involves two main types of inference:

• Forward inference (or prediction): In this case, given some evidence (observed values), the network is used to compute the probability of one or more hidden or unobserved nodes.

• Diagnostic inference: In this case, there is evidence on some nodes and the goal is to infer the values of other nodes for which there is no direct evidence. It is commonly used for medical diagnosis, a situation where there are observed symptoms, and one wants to infer the possible underlying causes.

Bayesian networks have a wide range of applications, including medical diagnosis, pattern recognition, recommender systems, risk analysis, engineering, decision making, and others. They are particularly useful in complex situations involving uncertainty and probabilistic dependencies among variables.

Using the relationships specified by the Bayesian network, a compact, factorized representation of the joint probability distribution can be obtained by leveraging conditional independence, figure 3. A Bayesian network is a directed acyclic graph where each edge represents a conditional dependency, and each node represents a unique random variable. Formally, if an edge (A, B) exists in the graph connecting random variables A and B, it implies that P(B|A) is a factor in the joint probability distribution. Therefore, P(B|A) must be known for all values of B and A to perform inference.

Consider the example where Rain has an edge pointing to WetGrass. This indicates that P(WetGrass|Rain) will be a factor, with its probability values specified next to the WetGrass node in a conditional probability table (CPT).

This factorization allows the joint probability distribution to be decomposed into a product of local probability distributions, one for each node in the network. This compact representation simplifies computations and makes it more efficient to perform inference and update beliefs as new evidence becomes available.

In summary, Bayesian networks provide a structured framework for representing and reasoning about complex probabilistic relationships among variables, enabling efficient inference and decision-making under uncertainty.

Case Study: WannaCry

To carry out this project, it was necessary to select a malware family so that it would be possible to test and validate the model of the Bayes algorithm for pattern recognition. The selected malware was WannaCry, a malicious software in the ransomware category that financially affected several companies around the world in 2017.

Also known as

Reference Architecture

The project's architecture utilizes AWS and Git Actions to create an efficient and automated data collection and analysis solution. The project is developed in JavaScript, leveraging the Serverless Framework for lambda function implementation. The development and operation of the architecture were divided into stages, as shown in Figure 4.

The image shows an architecture for using Amazon EC2 to process security data. EC2 is a scalable, secure cloud computing service that provides compute instances. It can be used for a variety of tasks, including data processing, security analytics, and machine learning.

The image shows how EC2 can be used to process security data from a variety of sources, including Alien Vault, an IT security platform. Data is collected by Alien Vault and sent to Amazon S3, a cloud storage service. EC2 can then be used to process the data and generate security reports.

The image also shows how EC2 can be used to train and deploy machine learning models for security.

Machine learning models can be used to detect security threats and protect an organization's data.

EC2 is a powerful tool that can be used to improve an organization's IT security. It can be used to process security data, generate security reports, and train and deploy machine learning models for security. To perform an efficient data extraction process, it was crucial to establish a deep understanding of the AlienVault platform. It serves as a valuable data source for our Bayesian analysis, providing information about security threats in JSON format through its API. This data includes details about security events, indicators of compromise, and other relevant information.

Bayesian analysis assumes that we have a complete understanding of the variables in our model. Therefore, we explored the possibilities offered by AlienVault, such as the ability to access historical threat information and the identification of patterns that could be useful in our analysis.

Here are some specific examples of how we leveraged AlienVault's capabilities to enhance our data extraction process:

• Historical Threat Information: AlienVault maintains a comprehensive database of historical threat information, including details about past security incidents, vulnerabilities, and attack techniques. We used this information to train our Bayesian model and to identify patterns that could be used to detect new and emerging threats.

• Indicators of Compromise (IOCs): AlienVault provides a rich set of IOCs, which are indicators that a system has been compromised. We used these IOCs to identify compromised systems and to investigate security incidents.

• Threat Intelligence Feeds: AlienVault offers a variety of threat intelligence feeds, which provide real-time information about the latest security threats. We used these feeds to keep our Bayesian model up to date with the latest threat information.

By leveraging the capabilities of AlienVault, we were able to extract high-quality data that was essential for our Bayesian analysis. The data extraction process was efficient and effective, and it enabled us to develop a Bayesian model that was able to accurately detect and classify security threats.

6.

Approaches to API Consumption

Once the API is developed and deployed, it needs to be consumed by client applications ( HERATH,2019).

There are several ways to consume an API, but the most common methods are:

• Direct API Calls: Client applications can directly call the API endpoints using programming languages such as Python, Java, or JavaScript. This method provides the most flexibility and control over the API calls, but it also requires more development effort.

• API Clients: API clients are libraries or frameworks that provide a convenient way to interact with APIs. They handle tasks such as authentication, error handling, and data formatting, making it easier for developers to consume APIs. Some popular API clients include Axios, Requests, and Postman.

• SDKs: Software development kits (SDKs) are comprehensive toolkits that provide a set of libraries, tools, and documentation to help developers integrate with specific APIs. SDKs typically include API clients, code samples, and documentation, making it easier for developers to get started with an API.

When consuming an API, it is important to follow best practices such as:

• Authentication and Authorization: Implement proper authentication and authorization mechanisms to ensure that only authorized users can access the API.

• Error Handling: Handle errors gracefully and provide meaningful error messages to help developers debug issues.

• Versioning: Use API versioning to allow clients to continue using the API even when it undergoes changes.

• Documentation: Provide comprehensive documentation, including API reference documentation, tutorials, and code samples, to help developers understand and use the API effectively.

By following these best practices, you can ensure that your API is easy to consume and integrate with client applications, in accordance with Herath, 2019.

AlienVault API data collection is one of the fundamental pillars of the project. The platform provides pulses that contain valuable information about malware threats. To ensure a comprehensive dataset, more than 20 accounts were registered in AlienVault, each providing pulses related to different types of malwares, partial source code shown in Figure 5. The data collection development was executed using JavaScript and the serverless architecture in conjunction with the AWS service. Two Lambda functions were created with schedules that operated every 2 minutes, running uninterruptedly for more than 2 months. One function was dedicated to collecting pulses from other malwares, while the second focused only on pulses related to WannaCry (Figure 6). AWS dashboard displaying the S3 buckets used to store the pulses queried on the AlienVault platform. Source: Own authorship Data collection development was executed using JavaScript and the serverless architecture in conjunction with the AWS service. Two Lambda functions were created with schedules that operated every 2 minutes, running uninterruptedly for more than 2 months. One function was dedicated to collecting pulses from other malwares, while the second focused only on pulses related to WannaCry.

The collected data was stored in Amazon S3, where it was organized into directories corresponding to the types of malwares that would be fundamental for later analysis.

After collection, the next step was preparing the data for Bayesian analysis. This phase included the extraction of raw data and subsequent cleaning. The cleaning techniques applied in Python were:

• Removal of Duplicates: In the cleaning process, checking for and eliminating duplicate entries was crucial. The goal was to ensure that the data was unique, avoiding distortions in the analysis.

• Treatment of Missing Values: Identification and treatment of missing values. Approaches such as filling with mean values, zero, or deleting records, as appropriate, were applied to preserve data integrity.

• Format Standardization: Standardization of the data format, facilitating subsequent analysis. Consistency in data format is essential to ensure accurate results in Bayesian analysis.

• Removal of Outliers: Identification and treatment of outliers, which can distort the conclusions of the analysis.

• Encoding of Categorical Variables: Categorical variables were transformed into appropriate numerical formats, a common practice in statistical analysis.

After cleaning, the data was consolidated into a single JSON file, preparing it for Bayesian analysis. The total database reached 287.7 MB. In Figure 12, the code shows the processing performed in June 2023 by the authors, from a database collected in October 2018 of pulses from the Alien Vault platform.

Application of the Models

8.

Naive Bayes is an algorithm used for data classification based on the probabilities of events and variables associated with that data. It assumes that the features of the data are independent of each other, which makes it particularly effective in situations where this assumption is reasonable.

The generic code basic of the Naive Bayes algorithm is shown in Figure 7 in the previous response:

• The algorithm starts with a training dataset of labeled data.

• The algorithm then calculates the probability of each feature in the dataset, given the class label.

• The algorithm also calculates the probability of each class label.

• To classify a new data point, the algorithm calculates the probability of the data point belonging to each class, given the values of its features.

• The class with the highest probability is then assigned to the data point.

This code defines the parameters of a Gaussian Naive Bayes model using the scikit-learn library in Python.

The code first loads the training data from a CSV file, then separates the features and the target variable. It then creates a Gaussian Naive Bayes classifier and fits it to the training data. Finally, it saves the classifier to a file using the pickle library.

Gaussian Naive Bayes (GNB) is a classification technique used in machine learning that is based on a probabilistic approach and assumes that each class follows a normal distribution. A Gaussian distribution, also known as a normal distribution, is a bell-shaped curve that is often used to model real-world data. The Gaussian distribution is characterized by two parameters: the mean and the standard deviation. The mean is the center of the distribution, and the standard deviation is a measure of how spread out the distribution is. A brief explanation of the code:

• The import statements at the beginning of the code import the necessary libraries.

• The pd.read_csv() function is used to load the training data from a CSV filea sample data.

• The drop() function is used to remove the target variable from the features.

• The GaussianNB() function is used to create a Gaussian Naive Bayes classifier.

• The fit() function is used to fit the classifier to the training data.

• The pickle.dump() function is used to save the classifier to a file.

The naive_bayes_classifier.sav file can then be used to load the classifier and make predictions on new data.

Gaussian Naive Bayes assumes that each feature in the data is independent of all other features, given the class label. This assumption is often not true in practice, but it can still lead to good classification accuracy.

To classify a new data point, Gaussian Naive Bayes calculates the probability of the data point belonging to each class, given the values of its features. The class with the highest probability is then assigned to the data point.

The term "naive" in Gaussian Naive Bayes refers to the assumption that the features are independent of each other. This assumption is often not true in practice, but it can still lead to good classification accuracy.

Gaussian Naive Bayes is often used for text classification and spam filtering. It can also be used for other classification tasks, such as image classification and medical diagnosis [START_REF] Oliveira | Aprendizagem de máquina para classificação de imagens médicas. Tese de doutorado[END_REF].

A company wants to use Gaussian Naive Bayes to classify customer support tickets as either "high priority" or "low priority". The company has a dataset of labeled customer support tickets, which includes features such as the customer's name, the date and time of the ticket, the subject of the ticket, and the body of the ticket.

The company can use Gaussian Naive Bayes to train a classifier that can predict the priority of a new customer support ticket, given the values of its features. The classifier can then be used to help the company prioritize customer support tickets and respond to them more quickly.

In line with this project, the use of this algorithm covers several domains, including threat and malware detection from log samples, Figure 8. The Naive Bayes algorithm works by calculating the probability of a data point belonging to a particular class, given the values of its features. The class with the highest probability is then assigned to the data point.

The Naive Bayes algorithm is relatively simple to implement and can be used to classify data very quickly. However, it is important to note that the assumption of independence between features can sometimes lead to inaccurate results.

In the context of malware detection, the Naive Bayes algorithm can be used to classify log samples as either malicious or benign. The algorithm can be trained on a dataset of labeled log samples, and then used to classify new log samples.

The Naive Bayes algorithm has been shown to be effective for malware detection. In one study, the Naive Bayes algorithm was able to achieve a detection rate of 98% with a false positive rate of only 2%.

The main feature of Naive Bayes is the ability to create classes or categories based on predefined criteria. This approach is particularly valuable in supervised problems, where it is possible to define these probability criteria based on the specific needs of the project. For example, it is possible to calculate the probability of a log indicating the presence of the WannaCry malware. The implementation of the Naive Bayes algorithm involved the following steps:

Application of Naive Bayes

The implementation of Naive Bayes used the Multinomial Naive Bayes model, a variant specially designed for text classification, as per the code explicit in figure 9.

Results Analysis

The analysis of results represents a crucial point in the research on the application of Bayesian networks in the detection of cyberattacks. In this section, the main findings that emerged from our research will be presented and discussed. Throughout this study, an extensive process of data collection and implementation of Bayesian network models was conducted with the aim of revealing significant insights into the nature of cyberattacks and thus contributing to the strengthening of cybersecurity. The findings that will be presented below highlight a promising use of Bayesian networks as an analytical tool, although they also show the need for improvements in the model to achieve greater accuracy. The code snippet in Figure 10 shows the execution of the tests. Indicators of Compromise (IOCs) can be used to identify ransomware infections. An IOC is any piece of information that can be used to identify a threat. WannaCry IOCs include:

• IP addresses of C&C domains and servers: WannaCry uses a set of IP addresses of C&C domains and servers to communicate with its command-and-control infrastructure.

• Malware files: WannaCry uses a set of malware files to spread and encrypt system files.

• Network behaviors: WannaCry may exhibit certain network behaviors, such as attempts to access IP addresses of C&C domains and servers.

Conditional probability is a measure of the probability of an event occurring given that another event has already occurred. In the context of WannaCry, the conditional probability of an IOC occurring given that the malware is already present can be used to identify ransomware infections.

The conditional probability of other WannaCry IOCs was also high in the 2017 outbreak. The conditional probability of a WannaCry malware file occurring given that the malware is already present was 95% at the time. The conditional probability of a WannaCry network behavior occurring given that the malware is already present was 90%, table 5, in accordance with [START_REF] Oliveira | A Bayesian Network Model for WannaCry Ransomware Detection[END_REF].

Indicator of Compromise (IOC) Conditional Probability

IP address of C&C domain or server 99%

Malware file 95%

Network behavior 90%

Table 5 -Probability Conditional IOC, by Oliveira, 2022.

These probabilities are based on the 2017 WannaCry outbreak. The conditional probability of an IOC occurring given that the malware is already present can vary depending on the specific IOC and the context in which it is being used.

For example, the conditional probability of a specific IP address of a C&C domain or server occurring given that the malware is already present may be higher if the IP address is known to be associated with WannaCry infections. Similarly, the conditional probability of a specific malware file occurring given that the malware is already present may be higher if the file is known to be a component of WannaCry, table 6.

Indicator Conditional Probability

Malicious IP address 0.9 Indicators can be collected from a variety of sources, Oliveira(2022), including:

Malicious file

• Security logs: Security logs record security-related events that occur on a system or network. Security logs can be used to detect IOCs and IOAs.

• Security sensors: Security sensors are devices or software that monitor the activity of a system or network and alert on suspicious activity. Security sensors can be used to detect IOCs, IOAs, and IOTs.

• Threat intelligence feeds: Threat intelligence feeds provide information about the latest threats and security vulnerabilities. Threat intelligence feeds can be used to detect IOTs.

Indicators are an important tool for detecting and preventing attacks, threats, and security breaches.

Indicators can be used to:

• Detect attacks and threats in real time: Indicators can be used to detect attacks and threats in real time, allowing organizations to respond quickly and mitigate damage.

• Prevent attacks and threats: Indicators can be used to prevent attacks and threats by blocking suspicious activity before it can cause harm.

• Investigate attacks and security breaches: Indicators can be used to investigate attacks and security breaches, helping organizations understand how the attack or breach occurred and how to prevent future attacks or breaches.

Indicators are an essential tool for information security. Organizations can use indicators to detect, prevent, and investigate attacks, threats, and security breaches, thereby protecting their information assets.

It is important to note that these probabilities are just estimates. The actual probability of an IOC occurring given that the malware is already present may vary depending on several factors, such as the specific IOC, the context in which it is being used, and the specific WannaCry variant.

Despite these limitations, the conditional probabilities of WannaCry IOCs can be used to create detection rules that can be used to identify ransomware infections. These rules can be used by security solutions to block ransomware infections or alert to a possible compromise.

Northcutt, 2019, asserts that indicators are signs or evidence that can be used to detect or identify something.

In the context of information security, indicators can be used to detect or identify attacks, threats, or security breaches.

There are many different types of indicators, including:

• Indicators of compromise (IOCs): Evidence that a system or network has been compromised by an attack or threat. IOCs can include malicious IP addresses, hashes of malicious files, malicious URLs, etc.

• Indicators of attack (IOAs): Evidence that an attack is in progress or about to occur. IOAs can include suspicious login attempts, anomalous network traffic, etc.

• Indicators of threat (IOTs): Evidence that a threat exists or is about to occur. IOTs can include security vulnerabilities, misconfigurations, etc.

The conditional probability of WannaCry IOCs can be used to create detection rules that can be used to identify ransomware infections. These rules can be used by security solutions to block ransomware infections or alert to a possible compromise.

In this sense, the developed model presented an average accuracy of 67.47%, which is a significant result, considering the peculiarities of malware detection (figure 11). The results of the analysis indicated that applying Bayesian networks to identify WannaCry threats based on specific indicators is a promising approach. Some of the key findings include:

• Infection Probability: The Bayesian network was able to calculate the probability of an IP being an indicator of a WannaCry attack. This allowed for the identification of IPs with a higher conditional probability related to WannaCry.

• Early Detection: Early detection of potential WannaCry attack indicators was feasible through an implementation of the model and a database containing malware samples. This can be used to take preventive measures before the infection spreads.

Implications of the Results in a Business Context

Considering the results, in a possible use of the case study for a business context, the implications may involve the application of techniques such as resampling, hyperparameter optimization, or the inclusion of additional WannaCry-specific data to improve the model's sensitivity. In a business context, these considerations translate into essential strategic choices. Cybersecurity transcends the technical sphere, integrating itself as a fundamental part of overall business risk management.

Continuous investment in model improvements, aligned with an understanding of the specific challenges faced, is crucial to ensuring the integrity of systems. These strategic decisions aim not only to strengthen the cybersecurity posture but also have direct implications for the resilience and reliability of the business.

In an increasingly complex and threatening digital landscape, the approach to overcoming these challenges is fundamental to ensuring the success and continuity of business operations.

9.Conclusions

After obtaining an accuracy of 67.47%, when compared to the research Machine Learning Aided Static Malware Analysis: A Survey and Tutorial, this article corroborates with the work elaborated by the authors Andrii Shalaginov, Sergii Banin, Ali Dehghantanha, and Katrin Franke, who conclude that the use of Bayesian networks obtains lower accuracy rates when compared to other Pattern Recognition and Machine Learning mechanisms such as KNN and C4.5.

Therefore, with the results of this project analyzed and compared, it was identified that the use of Bayesian network algorithms for identifying malware patterns is not the ideal technique, and that the model developed in this research requires improvements. Having the WannaCry malware as a study base, the effectiveness of our algorithm was like that of IDS and IPS solutions available on the market and other applications of the technique in recognizing other malware.

In a global context in which cyberattacks are constantly evolving, the accuracy achieved by the proposed algorithm may not be sufficient to generate satisfactory results regarding detected threats. However, when combined with other techniques for detecting and mitigating malicious activities, the use of Bayesian networks as a means of pattern recognition can be implemented in IDS and IPS systems so that it can be combined with other detection techniques, resulting in increasingly efficient protection systems that, in turn, will reduce the number of false positives sent to security monitoring teams and allow these teams to perform their functions more assertively, providing increasingly secure systems.

Figure 1 -

 1 Figure 1 -Categorization techniques ML. Source:[START_REF] Akhtar | Evaluation of Machine Learning Algorithms for Malware Detection[END_REF]

Figure 3 -

 3 Figure 3 -Sample Bayesian Networks. Source: Soni, 2018.

  WannaCrypt, WCry, WCrypt, and WanaCrypt0r 2.0, the ransomware spread rapidly during the month of May 2017. The malicious software exploited a vulnerability in Microsoft Windows systems known as Eternal Blue, an exploit first developed confidentially by the United States National Security Agency (NSA) and later leaked and released by the criminal group Shadow Brokers on April 14, 2017. The vulnerability exploited a flaw in the implementation of Microsoft's Server Message Block (SMB) protocol in its first version (SMBv1), used for file and printer sharing on local networks. Due to poor packet handling by the protocol, the exploit allowed for the occurrence and exploitation of a flaw known as Remote Code Execution (RCE), which results in the execution of remote code on the victim's machine by the attacker.

Figure 4 :

 4 Figure 4: Cloud Architecture (AWS) Used for Project Development Source: Own Authorship

Figure 5 :

 5 Figure 5: Python code responsible for querying the AlienVault platform API and storing the data in S3 buckets. Source: Own authorship

Figure 6 :

 6 Figure 6: AWS dashboard displaying the S3 buckets used to store the pulses queried on the AlienVault platform. Source: Own authorship.

Figure 7 .

 7 Figure 7. Generic code basic of the Naive Bayes algorithm. Source: Own authorship.

Figure 8 .

 8 Figure 8. Implementation Model Naive Bayes algorithm. Source: Own authorship.

Figure 9 :

 9 Figure 9: Python code used for the implementation of the Multinomial Naive Bayes algorithm. Source: Own authorship

Figure 10 :

 10 Figure 10: Model applied to a database of various malicious software and with 67.47% effectiveness in detecting WannaCry malware. Source: Own authorship.

Figure 11 -

 11 Figure 11 -Conditional Probability of WannaCry Indicators (Graph). Source: Own elaboration

Figure 12 -

 12 Figure 12 -Conditional probability of WannaCry indicators Source: Own authorship

Table 1 -

 1

Mitigating False Positives in IDS/IPS. Source: Autor's compilation

Table 2 -

 2 Classification accuracy based on API call 2-gram features, %. Source: ISLAM et al (2023).The result 62.31% represents the classification accuracy of a Machine Learning algorithm in detecting malware, based on API call 2-gram features. This means that the algorithm was able to correctly classify 62.31% of the malware and benign programs in the dataset.

Table 3 -

 3

Comparative classification accuracy of different Machine Learning algorithms in detecting malware. Source: Shukurov et al., 2022.

Table 4 -

 4 Comparison of the accuracy rate of different Machine Learning algorithms in malware detection.

Source: AKHTAR & FENG (2022).

Table 6 -

 6 Conditional Probability of WannaCry Indicators, by[START_REF] Oliveira | A Bayesian Network Model for WannaCry Ransomware Detection[END_REF]

	0.1