Ransomware Detection Using the Dynamic Analysis and Machine Learning: A Survey and Research Directions
Source abstract
Abstract
Ransomware is an ill-famed malware that has received recognition because of its lethal and irrevocable effects on its victims. The irreparable loss caused due to ransomware requires the timely detection of these attacks. Several studies including surveys and reviews are conducted on the evolution, taxonomy, trends, threats, and countermeasures of ransomware. Some of these studies were specifically dedicated to IoT and android platforms. However, there is not a single study in the available literature that addresses the significance of dynamic analysis for the ransomware detection studies for all the targeted platforms. This study also provides the information about the datasets collection from its sources, which were utilized in the ransomware detection studies of the diverse platforms. This study is also distinct in terms of providing a survey about the ransomware detection studies utilizing machine learning, deep learning, and blend of both techniques while capitalizing on the advantages of dynamic analysis for the ransomware detection. The presented work considers the ransomware detection studies conducted from 2019 to 2021. This study provides an ample list of future directions which will pave the way for future research.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Advanced Malware Detection Techniques · Network Security and Intrusion Detection · Spam and Phishing Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computing, Faculty of Engineering, Universiti Teknologi Malaysia, Johor Bahru 81300, Johor, Malaysia
Department of Information Technology, College of Computer, Qassim University, Buraydah 51452, Saudi Arabia
Faculty of Engineering and Information Technology, Taiz University, Taiz 6803, Yemen
References (100+)
Show source-provided references
1. An Adaptive Protection of Flooding Attacks Model for Complex Network Environments10.1155/2021/5542919 ↗
2. DeepIoT. IDS: Hybrid Deep Learning for Enhancing IoT Network Intrusion Detection
3. Young, A., and Yung, M. (1996, January 6–8). Cryptovirology: Extortion-Based security threats and countermeasures. Proceedings of the 1996 IEEE Symposium on Security and Privacy, Oakland, CA, USA.
4. Aboaoja, F.A., Zainal, A., Ghaleb, F.A., and Al-rimy, B.A.S. (2021, January 6–7). Toward an Ensemble Behavioral-Based Early Evasive Malware Detection Framework. Proceedings of the 2021 International Conference on Data Science and Its Applications (ICoDSA), Bandung, Indonesia.10.1109/ICoDSA53588.2021.9617489 ↗
5. Alghofaili, Y., Albattah, A., Alrajeh, N., Rassam, M.A., and Al-rimy, B.A.S. (2021). Secure Cloud Infrastructure: A Survey on Issues, Current Solutions, and Open Challenges. Appl. Sci., 11.10.3390/app11199005 ↗
6. Experimental analysis of ransomware on windows and android platforms: Evolution and characterization10.1016/j.procs.2016.08.072 ↗
7. Fernandez Maimo, L., Huertas Celdran, A., Perales Gomez, A.L., Garcia Clemente, F.J., Weimer, J., and Lee, I. (2019). Intelligent and dynamic ransomware spread detection and mitigation in integrated clinical environments. Sensors, 19.10.3390/s19051114 ↗
8. Mercaldo, F., Nardone, V., Santone, A., and Visaggio, C.A. (2016, January 6–9). Ransomware steals your phone. Formal methods rescue it. Proceedings of the International Conference on Formal Techniques for Distributed Objects, Components, and Systems, Heraklion, Crete.10.1007/978-3-319-39570-8_14 ↗
9. Scaife, N., Carter, H., Traynor, P., and Butler, K.R. (2016, January 27–30). Cryptolock (and drop it): Stopping ransomware attacks on user data. Proceedings of the 2016 IEEE 36th International Conference on Distributed Computing Systems (ICDCS), Nara, Japan.10.1109/ICDCS.2016.46 ↗
10. A Multi-Agent Approach for the
11. Comito, C., Forestiero, A., and Pizzuti, C. (2019, January 14–17). Word embedding based clustering to detect topics in social media. Proceedings of the 2019 IEEE/WIC/ACM International Conference on Web Intelligence (WI), Thessaloniki, Greece.10.1145/3350546.3352518 ↗
12. Forestiero, A., Mastroianni, C., Meo, M., Papuzzo, G., and Sheikhalishahi, M. (2014). Hierarchical approach for green workload management in distributed data centers. European Conference on Parallel Processing, Springer.10.1007/978-3-319-14325-5_28 ↗
13. Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L., and Kirda, E. (2015, January 9–10). Cutting the gordian knot: A look under the hood of ransomware attacks. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Milan, Italy.10.1007/978-3-319-20550-2_1 ↗
14. Kharaz, A., Arshad, S., Mulliner, C., Robertson, W., and Kirda, E. (2016, January 10–12). {UNVEIL}: A large-scale, automated approach to detecting ransomware. Proceedings of the 25th {USENIX} Security Symposium ({USENIX} Security 16), Austin, TX, USA.
15. Popli, N.K., and Girdhar, A. (2019). Behavioural analysis of recent ransomwares and prediction of future attacks by polymorphic and metamorphic ransomware. Computational Intelligence: Theories, Applications and Future Directions—Volume II, Springer.10.1007/978-981-13-1135-2_6 ↗
16. Avoiding future digital extortion through robust protection against ransomware threats using deep learning based adaptive approaches10.1109/ACCESS.2020.2970466 ↗
17. A pseudo feedback-based annotated TF-IDF technique for dynamic crypto-ransomware pre-encryption boundary delineation and features extraction10.1109/ACCESS.2020.3012674 ↗
18. A Ghaleb, F., Saeed, F., Al-Sarem, M., Ali Saleh Al-rimy, B., Boulila, W., Eljialy, A., Aloufi, K., and Alazab, M. (2020). Misbehavior-Aware on-demand collaborative intrusion detection system using distributed ensemble learning for VANET. Electronics, 9.10.3390/electronics9091411 ↗
19. Geluvaraj, B., Satwik, P., and Kumar, T.A. (2019, January 23–24). The future of cybersecurity: Major role of artificial intelligence, machine learning, and deep learning in cyberspace. Proceedings of the International Conference on Computer Networks and Communication Technologies, Coimbatore, India.10.1007/978-981-10-8681-6_67 ↗
20. Ransomware detection using machine learning algorithms10.1002/cpe.5422 ↗
21. Krishnan, K.S., and Thampi, S.M. (2020). Deep Learning Approaches for IoT Security in the Big Data Era. Combating Security Challenges in the Age of Big Data, Springer.10.1007/978-3-030-35642-2_6 ↗
22. Faris, H., Habib, M., Almomani, I., Eshtay, M., and Aljarah, I. (2020). Optimizing extreme learning machines using chains of salps for efficient Android ransomware detection. Appl. Sci., 10.10.3390/app10113706 ↗
23. Zero-day aware decision fusion-based model for crypto-ransomware early detection
24. Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions10.1016/j.cose.2018.01.001 ↗
25. Herrera Silva, J.A., Barona López, L.I., Valdivieso Caraguay, Á.L., and Hernández-Álvarez, M. (2019). A Survey on Situational Awareness of Ransomware Attacks—Detection and Prevention Parameters. Remote Sens., 11.10.3390/rs11101168 ↗
26. Ransomware: A Survey and Trends
27. Ransomware, threat and detection techniques: A review
28. Alzahrani, N., and Alghazzawi, D. (2019, January 12–14). A Review on Android Ransomware Detection Using Deep Learning Techniques. Proceedings of the 11th International Conference on Management of Digital EcoSystems, Limassol, Cyprus.10.1145/3297662.3365785 ↗
29. A survey of machine and deep learning methods for internet of things (IoT) security10.1109/COMST.2020.2988293 ↗
30. A Review of Deep Learning Security and Privacy Defensive Techniques
31. Berman, D.S., Buczak, A.L., Chavis, J.S., and Corbett, C.L. (2019). A survey of deep learning methods for cyber security. Information, 10.10.3390/info10040122 ↗
32. Noorbehbahani, F., Rasouli, F., and Saberi, M. (2019, January 28–29). Analysis of machine learning techniques for ransomware detection. Proceedings of the 2019 16th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC), Mashhad, Iran.10.1109/ISCISC48546.2019.8985139 ↗
33. Fernando, D.W., Komninos, N., and Chen, T. (2020). A Study on the Evolution of Ransomware Detection Using Machine Learning and Deep Learning Techniques. IOT, 1.10.3390/iot1020030 ↗
34. Oz, H., Aris, A., Levi, A., and Uluagac, A.S. (2021). A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions. arXiv.10.1145/3514229 ↗
35. A survey on analysis and detection of Android ransomware10.1002/cpe.6272 ↗
36. Kumari, M. (2019). Application of Machine Learning and Deep Learning in Cybercrime Prevention—A Study. Int. J. Trend Res. Dev., 1–4.
37. KP, S. (2018). A short review on Applications of Deep learning for Cyber security. arXiv.
38. Internet of things and ransomware: Evolution, mitigation and prevention10.1016/j.eij.2020.05.003 ↗
39. Information security breaches due to ransomware attacks-a systematic literature review
40. Olaimat, M.N., Maarof, M.A., and Al-rimy, B.A.S. (2021, January 29–31). Ransomware Anti-Analysis and Evasion Techniques: A Survey and Research Directions. Proceedings of the 2021 3rd International Cyber Resilience Conference (CRC), Langkawi Island, Malaysia.10.1109/CRC50527.2021.9392529 ↗
41. Hu, J.W., Zhang, Y., and Cui, Y.P. (2020). Research on Android ransomware protection technology. Journal of Physics: Conference Series, IOP Publishing.10.1088/1742-6596/1584/1/012004 ↗
42. Systematic literature review and metadata analysis of ransomware attacks and detection mechanisms10.1007/s40860-019-00080-3 ↗
43. Deep learning applications in cyber security: A comprehensive review, challenges and prospects
44. Detecting ransomware attacks using intelligent algorithms: Recent development and next direction from deep learning and big data perspectives10.1007/s12652-020-02630-7 ↗
45. Sneha, M., Arya, A., and Agarwal, P. (2020, January 18–20). Ransomware Detection techniques in the Dawn of Artificial Intelligence: A Survey. Proceedings of the 2020 the 9th International Conference on Networks, Communication and Computing, Tokyo, Japan.10.1145/3447654.3447659 ↗
46. Urooj, U., Maarof, M.A.B., and Al-rimy, B.A.S. (2021, January 29–31). A proposed Adaptive Pre-Encryption Crypto-Ransomware Early Detection Model. Proceedings of the 2021 3rd International Cyber Resilience Conference (CRC), Langkawi Island, Malaysia.10.1109/CRC50527.2021.9392548 ↗
47. Mbol, F., Robert, J.-M., and Sadighian, A. (2016, January 14–16). An efficient approach to detect torrentlocker ransomware in computer systems. Proceedings of the International Conference on Cryptology and Network Security, Milan, Italy.10.1007/978-3-319-48965-0_32 ↗
48. Alrawashdeh, K., and Purdy, C. (2018, January 23–26). Ransomware detection using limited precision deep learning structure in fpga. Proceedings of the NAECON 2018-IEEE National Aerospace and Electronics Conference, Dayton, OH, USA.10.1109/NAECON.2018.8556824 ↗
49. Feng, Y., Liu, C., and Liu, B. (2017, January 22–24). Poster: A new approach to detecting ransomware with deception. Proceedings of the 38th IEEE Symposium on Security and Privacy Workshops, San Jose, CA, USA.
50. Paik, J.-Y., Shin, K., and Cho, E.-S. (2016, January 23–25). Poster: Self-defensible storage devices based on flash memory against ransomware. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA.
51. Ransomware digital extortion: A rising new age threat10.17485/ijst/2016/v9i14/82936 ↗
52. Redundancy coefficient gradual up-weighting-based mutual information feature selection technique for crypto-ransomware early detection10.1016/j.future.2020.10.002 ↗
53. Comparative analysis of various ransomware virii10.1007/s11416-008-0092-2 ↗
54. SSD-Assisted Ransomware Detection and Data Recovery Techniques
55. The effective ransomware prevention technique using process monitoring on android platform
56. R-Locker: Thwarting ransomware action through a honeyfile-based approach10.1016/j.cose.2017.11.019 ↗
57. Maiorca, D., Mercaldo, F., Giacinto, G., Visaggio, C.A., and Martinelli, F. (2017, January 3–7). R-PackDroid: API package-based characterization and detection of mobile ransomware. Proceedings of the Symposium on Applied Computing, Marrakech, Morocco.10.1145/3019612.3019793 ↗
58. Sgandurra, D., Muñoz-González, L., Mohsen, R., and Lupu, E.C. (2016). Automated dynamic analysis of ransomware: Benefits, limitations and use for detection. arXiv.
59. Alhawi, O.M., Baldwin, J., and Dehghantanha, A. (2018). Leveraging machine learning techniques for windows ransomware network traffic detection. Cyber Threat Intelligence, Springer.10.1007/978-3-319-73951-9_5 ↗
60. Know abnormal, find evil: Frequent pattern mining for ransomware threat hunting and intelligence10.1109/TETC.2017.2756908 ↗
61. Android Ransomware Detection Based on a Hybrid Evolutionary Approach in the Context of Highly Imbalanced Data10.1109/ACCESS.2021.3071450 ↗
62. DRTHIS: Deep ransomware threat hunting and intelligence system at the fog layer10.1016/j.future.2018.07.045 ↗
63. Maniath, S., Ashok, A., Poornachandran, P., Sujadevi, V., Sankar, A.P., and Jan, S. (2017, January 26–27). Deep learning LSTM based ransomware detection. Proceedings of the 2017 Recent Developments in Control, Automation & Power Engineering (RDCAPE), Noida, India.10.1109/RDCAPE.2017.8358312 ↗
64. Vinayakumar, R., Soman, K., Velan, K.S., and Ganorkar, S. (2017, January 13–16). Evaluating shallow and deep networks for ransomware detection and classification. Proceedings of the 2017 International Conference on Advances in Computing, Communications and Informatics (ICACCI), Udupi, India.10.1109/ICACCI.2017.8125850 ↗
65. Gharib, A., and Ghorbani, A. (2017). Dna-droid: A real-time android ransomware detection framework. International Conference on Network and System Security, Springer.10.1007/978-3-319-64701-2_14 ↗
66. Deep learning for ransomware detection
67. Kianpour, M., and Wen, S.-F. (2019, January 5–6). Timing attacks on machine learning: State of the art. Proceedings of the SAI Intelligent Systems Conference, London, UK.10.1007/978-3-030-29516-5_10 ↗
68. Kurakin, A., Goodfellow, I., and Bengio, S. (2016). Adversarial machine learning at scale. arXiv.
69. Making machine learning robust against adversarial inputs10.1145/3134599 ↗
70. Ameer, M. (2019). Android Ransomware Detection Using Machine Learning Techniques to Mitigate Adversarial Evasion Attacks. [Ph.D. Thesis, Capital University of Science and Technology].
71. Cara, F., Scalas, M., Giacinto, G., and Maiorca, D. (2020). On the Feasibility of Adversarial Sample Creation Using the Android System API. Information, 11.10.3390/info11090433 ↗
72. Andronio, N., Zanero, S., and Maggi, F. (2015, January 2–4). Heldroid: Dissecting and detecting mobile ransomware. Proceedings of the International Symposium on Recent Advances in Intrusion Detection, Kyoto, Japan.10.1007/978-3-319-26362-5_18 ↗
73. Classification of ransomware families with machine learning based on N-Gram of opcodes10.1016/j.future.2018.07.052 ↗
74. Ransomware classification using patch-based CNN and self-attention network on embedded N-grams of opcodes10.1016/j.future.2019.09.025 ↗
75. Moore, C. (2016, January 2–4). Detecting ransomware with honeypot techniques. Proceedings of the 2016 Cybersecurity and Cyberforensics Conference (CCC), Amman, Jordan.10.1109/CCC.2016.14 ↗
76. Network activity analysis of CryptoWall ransomware
77. A comparison of static, dynamic, and hybrid analysis for malware detection10.1007/s11416-015-0261-z ↗
78. Lokuketagoda, B., Weerakoon, M.P., Kuruppu, U.M., Senarathne, A.N., and Abeywardena, K.Y. (2018, January 8–11). R-Killer: An email based ransomware protection tool. Proceedings of the 2018 13th International Conference on Computer Science & Education (ICCSE), Colombo, Sri Lanka.10.1109/ICCSE.2018.8468807 ↗
79. Kok, S., Abdullah, A., and Jhanjhi, N. (2020). Early detection of crypto-ransomware using pre-encryption detection algorithm. J. King Saud Univ.-Comput. Inf. Sci., in press.10.3390/computers8040079 ↗
80. Ashraf, A., Aziz, A., Zahoora, U., Rajarajan, M., and Khan, A. (2019). Ransomware Analysis using Feature Engineering and Deep Neural Networks. arXiv.
81. Alam, M., Sinha, S., Bhattacharya, S., Dutta, S., Mukhopadhyay, D., and Chattopadhyay, A. (2020). RAPPER: Ransomware prevention via performance counters. arXiv.
82. Shukla, M., Mondal, S., and Lodha, S. (2016, January 24–28). Poster: Locally virtualized environment for mitigating ransomware threat. Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, New York, NY, USA.10.1145/2976749.2989051 ↗
83. Silva, J.A.H., and Hernández-Alvarez, M. (2017, January 16–20). Large scale ransomware detection by cognitive security. Proceedings of the 2017 IEEE Second Ecuador Technical Chapters Meeting (ETCM), Salinas, Ecuador.
84. Al-rimy, B.A.S., Maarof, M.A., and Shaid, S.Z.M. (2017, January 23–24). A 0-day aware crypto-ransomware early behavioral detection framework. Proceedings of the International Conference of Reliable Information and Communication Technology, Johor Bahru, Malaysia.10.1007/978-3-319-59427-9_78 ↗
85. DeepRan: Attention-based BiLSTM and CRF for Ransomware Early Detection and Classifcation10.1007/s10796-020-10017-4 ↗
86. ISTR April 2017
87. Two-stage ransomware detection using dynamic analysis and machine learning techniques10.1007/s11277-020-07166-9 ↗
88. Al-Hawawreh, M., and Sitnikova, E. (2019, January 12–14). Leveraging deep learning models for ransomware detection in the industrial internet of things environment. Proceedings of the 2019 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.10.1109/MilCIS.2019.8930732 ↗
89. Al-Hawawreh, M., and Sitnikova, E. (2019, January 22–24). Industrial Internet of Things based ransomware detection using stacked variational neural network. Proceedings of the 3rd International Conference on Big Data and Internet of Things, Melbourn, Australia.10.1145/3361758.3361763 ↗
90. Machine learning based file entropy analysis for ransomware detection in backup systems10.1109/ACCESS.2019.2931136 ↗
91. Ahmadian, M.M., Shahriari, H.R., and Ghaffarian, S.M. (2015, January 8–10). Connection-monitor & connection-breaker: A novel approach for prevention and detection of high survivable ransomwares. Proceedings of the 2015 12th International Iranian Society of Cryptology Conference on Information Security and Cryptology (ISCISC), Rasht, Iran.10.1109/ISCISC.2015.7387902 ↗
92. Da-Yu, K., HSIAO, S.-C., and Raylin, T. (2019, January 17–20). Analyzing WannaCry ransomware considering the weapons and exploits. Proceedings of the 2019 21st International Conference on Advanced Communication Technology (ICACT), PyeongChang, Korea.
93. Cusack, G., Michel, O., and Keller, E. (2018, January 21). Machine learning-based detection of ransomware using SDN. Proceedings of the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, Tempe, AZ, USA.10.1145/3180465.3180467 ↗
94. A system call refinement-based enhanced Minimum Redundancy Maximum Relevance method for ransomware early detection10.1016/j.jnca.2020.102753 ↗
95. Crypto-ransomware early detection model using novel incremental bagging with enhanced semi-random subspace selection10.1016/j.future.2019.06.005 ↗
96. Zuhair, H., and Selamat, A. (2019). RANDS: A Machine Learning-Based Anti-Ransomware Tool for Windows Platforms. Advancing Technology Industrialization Through Intelligent Software Methodologies, Tools and Techniques, IOS Press.
97. Evaluation metric for crypto-ransomware detection using machine learning
98. Adamu, U., and Awan, I. (2019, January 26–28). Ransomware prediction using supervised learning algorithms. Proceedings of the 2019 7th International Conference on Future Internet of Things and Cloud (FiCloud), Istanbul, Turkey.10.1109/FiCloud.2019.00016 ↗
99. Chen, Q., Islam, S.R., Haswell, H., and Bridges, R.A. (2019, January 9–11). Automated ransomware behavior analysis: Pattern extraction and early detection. Proceedings of the International Conference on Science of Cyber Security, Nanjing, China.10.1007/978-3-030-34637-9_15 ↗
100. Pundir, N., Tehranipoor, M., and Rahman, F. (2020). RanStop: A Hardware-assisted Runtime Crypto-Ransomware Detection Technique. arXiv.