## 3 The State-of-The-Art of Anti-Ransomware Technology
as described briefly in Table 2. For a clear description, we illustrate the categories above, along with their advantages, are presented in Figure 2.  
The misuse-based anti-ransomware technology relies on either archiving the exploits and actions of ransomware families in a black-list or archiving exploits of good-ware apps in a white-list [6; 14; 15; 16]. However, it can detect the generic versions of the prevalent ransomware families exclusively as if the built-in archives are not frequently updated by the data of 0-Day versions [6; 16]. Furthermore, it consumes a longer time and more computer resources as well as human labor to trace ransomware exploits and actions [6; 10; 14]. Unlikely, the anomaly-based anti-ransomware technology can analyze ransomware' normal behaviors and generic processes statically and/or dynamically to deviate 0-Day versions [4; 6] (see Figure 2). Although anomaly-based anti-ransomware technology outperforms the misuse-based technology against 0-Day versions, it is still bypassed by versions of more advanced crypto coding families [6; 10; 14]. As described in Table 2, machine learning-based anti-ransomware technology applies various machine learners to cope with the problems of the former anti-ransomware technologies at discriminating 0-Day versions of different families expertly [6; 24]. Furthermore, the constructed machine learners take the advantages of static and/or dynamic analysis of ransomware traits to extract the vectors of traits and learn them with a compact set of traits [25; 26]. Precisely, they rely on different  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Table** & **Description** & **Demerits** & **Examples** \\ \hline \multirow{4}{*}{ \begin{tabular}{c} Misuse-Based \\ Technology [6; 14; 15; 16] \\ \end{tabular}  } & They analyze ransomware versions to extract cryptographic primitives, suspicious scripts, built-in functions, infected files’ & They can be defeated against 0-Day & Kaspersky \\  & & paths, and extensions. They achieved moderate accuracy in & Anonymous versions & McAfee \\  & lightweight performance & & -A lot of false alarms & Avast \\ \hline \multirow{4}{*}{ \begin{tabular}{c} Anomaly-Based \\ Technology [17; 18; 19; 20; 21; 22; 23] \\ \end{tabular}  } & They trace ransomware runtime activities, computer processes, CU and memory footprints, severe actions and control to detect ransomware versions effectively and efficiently & & \begin{tabular}{c} -The infirm vs. scalable network traffic \\ -They can be defeated vs. 0-Day ransomware \\ -Fragile analysis vs. big and imbalanced dataset \\ \end{tabular}  & \begin{tabular}{c} R-Locker \\ RansomFiner \\ \end{tabular}  \\ \cline{2-4}  & They analyze ransomware versions effectively and efficiently & & -The only can be defeated vs. 0-Day ransomware versions & [PERSON] \\  & & ransomware versions effectively and efficiently & & -Fragle analysis vs. big and imbalanced dataset & UNIVEL \\ \cline{2-4}  & & & \multicolumn{2}{c}{Talos} \\ \hline \multirow{4}{*}{ \begin{tabular}{c} Machine Learning-Based \\ Technology [11; 24; 15; 16; 17; 18; 19; 20; 21; 22; 23] \\ \end{tabular}  } & They apply machine learning algorithms to classify training and testing sets of ransomware and good-ware instances with a hybrid set of static and dynamic traits. Then, generated class & \ \begin{tabular}{c} -They can be evaded by adversarial \\ ransomware families \\ \end{tabular}  &
\begin{tabular}{c} ElsdeRan \\ ShieldFS \\ 2 emtFOX]{} } \\ \cline{2-4}  & \begindecisive functions, induction parameters, design, and class attributes to promote their discriminating power; for example, naive bayes (NB), support vector machine (SVM), decision tree (DT), logic regression (LR), bayesian network (BN), neural networks (k-NN), and random forest (RF), etc. as well as hybrid machine learners like (HMLC) that hybridizes multiple and complementary machine learners as presented in Table 3. Therefore, machine learning-based anti-ransomware technologies outperform their competitors [2, 3, 4].