A Survey on Ransomware Threats: Contrasting Static and Dynamic Analysis Methods

Abstract

The proliferation of ransomware poses a significant threat to global cybersecurity. This study presents a comprehensive review of the methodologies employed in the detection and analysis of ransomware, emphasizing the dichotomy between static and dynamic analysis approaches. It introduces the historical context and the necessity for robust cybersecurity measures, followed by an outline of the methodological framework used to evaluate existing ransomware analysis techniques. The results detail the effectiveness and limitations of various analysis strategies, identifying key features and patterns that aid in the detection and classification of ransomware threats. The study concludes by summarizing the primary achievements, including the identification of gaps in current research and proposing future research directions aimed at enhancing ransomware detection and mitigation strategies. The synthesis provided in this survey offers a consolidated view of the state-of-the-art in ransomware threat analysis and serves as a resource for cybersecurity professionals and researchers.

An Effective Strategy for Ransomware Mitigation on Android Devices via Android OS File System API

“…Researchers have observed a trend in the evolution of ransomware tactics from basic lockers to more sophisticated encryption-based methods [26,27]. Newer ransomware variants are increasingly incorporating tactics to evade detection by security software [28]. The diversity in Android device models and OS versions also contributed to the challenge of securing all devices uniformly [29].…”

“…Research has always advocated for a multi-layered security approach to effectively mitigate ransomware threats on mobile devices [30,28,31]. Traditional antivirus solutions have been found somewhat effective but insufficient alone due to the dynamic nature of ransomware attacks [13,32,33].…”

“…Traditional antivirus solutions have been found somewhat effective but insufficient alone due to the dynamic nature of ransomware attacks [13,32,33]. Combining real-time monitoring with behavior analysis could enhance detection rates [34,28]. Techniques involving the use of sandbox environments to isolate and analyze suspicious applications have shown promise in identifying ransomware before it can cause harm [35].…”

“…Researchers explored the potential of modifying API responses to mislead ransomware about the success of file encryption operations [7]. The application of heuristic techniques through API monitoring allowed for dynamic responses to suspected ransomware actions [28,27]. APIs could be used to create a secure vault area in the file system, where critical data could be isolated from malicious processes [27,43].…”

RanAway: A Novel Ransomware-Resilient ReFS File System

“…This exponential rise highlights not only the growing sophistication of ransomware attacks but also their expanding scope, targeting entities ranging from individual users to large corporations and government agencies [3]. The evolution of ransomware from relatively simple locker malware, which restricts access to the system or files without encrypting them, to highly sophisticated, self-propagating threats that exploit network vulnerabilities, signifies a shift in the threat landscape [3,1,4]. Modern ransomware variants, such as Wan-naCry and NotPetya, have demonstrated the capability to cause widespread disruption by leveraging encryption algorithms and propagation techniques that exploit flaws in network protocols, and have underscored the vulnerability of critical infrastructure and essential services to cyber extortion, leading to heightened scrutiny of cybersecurity defenses [2].…”