A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques

Abstract

This survey investigates the contributions of research into the detection of ransomware malware using machine learning and deep learning algorithms. The main motivations for this study are the destructive nature of ransomware, the difficulty of reversing a ransomware infection, and how important it is to detect it before infecting a system. Machine learning is coming to the forefront of combatting ransomware, so we attempted to identify weaknesses in machine learning approaches and how they can be strengthened. The threat posed by ransomware is exceptionally high, with new variants and families continually being found on the internet and dark web. Recovering from ransomware infections is difficult, given the nature of the encryption schemes used by them. The increase in the use of artificial intelligence also coincides with this boom in ransomware. The exploration into machine learning and deep learning approaches when it comes to detecting ransomware poses high interest because machine learning and deep learning can detect zero-day threats. These techniques can generate predictive models that can learn the behaviour of ransomware and use this knowledge to detect variants and families which have not yet been seen. In this survey, we review prominent research studies which all showcase a machine learning or deep learning approach when detecting ransomware malware. These studies were chosen based on the number of citations they had by other research. We carried out experiments to investigate how the discussed research studies are impacted by malware evolution. We also explored the new directions of ransomware and how we expect it to evolve in the coming years, such as expansion into IoT (Internet of Things), with IoT being integrated more into infrastructures and into homes.

Ransomware Detection using Process Memory

“…Over the years, significant advances have been made in ransomware detection, especially after the devastation that WannaCry caused in 2017 (Adamov & Carlsson, 2017;Berrueta, Morato, Magana, et al, 2020;Fernando, Komninos & Chen, 2020;Molina, Torabi, Sarieddine, et al, 2021;Singh et al, 2019a). Although researchers explored avenues for detection such as static and dynamic information, ransomware has managed to evade static analysis (Subedi et al, 2018).…”

Comparing Deep Learning and Shallow Learning Techniques for API Calls Malware Prediction: A Study

“…Malware are converted from binary files into images, then VGG16, AlexNet, DarkNet-53, DenseNet, and ResNet CNNs were trained in transfer learning mode on the proposed dataset reaching as high as 99.97% of accuracy, but without promoting insights about what are the learned patterns and how they correlate to malware. A survey on shallow and deep learning techniques to detect ransomware malware in IoT networks is provided in [19] by Fernando et al Instead, Ref. [20] provides a survey concerning malware detection in mobile devices (especially Android), categorizing the literature to three dimensions: type of analysis, features, and techniques.…”

Classificacção de Ransomware utilizando Algoritmos de Machine Learning

“…O aprendizado de máquina tem sido muito eficaz na detecc ¸ão de malwares, como mostram os trabalhos de [5], [6] [7], [8] e [9]. O ransomware tem sido um tópico de pesquisa muito ativo e vários pesquisadores propuseram pesquisas que se concentram em diferentes aspectos da pesquisa de ransomware.…”

“…O trabalho de [5] realizou uma pesquisa sobre a evoluc ¸ão da detecc ¸ão de ransomware usando aprendizado de máquina e técnicas de aprendizado profundo. O artigo avaliou 19 trabalhos, fazendo a abordagem algorítmica, o processo de engenharia de recursos, bem como a avaliac ¸ão de cada resultado.…”

“…Este processo de aprendizagem comec ¸a com a observac ¸ão (dados), com o objetivo de reconhecer padrões e, em seguida, tomar uma decisão melhor com base no conhecimento aprendido. Isso permite que os computadores aprendam automaticamente sem intervenc ¸ões humanas, assim como mostra [5].…”