## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.3 Detection
Early Detection Studies Utilizing Machine Learning  
Different early detection studies in the literature utilized the machine learning approach to detect the ransomware. Some of them are discussed here after. A crypto-ransomware detection system was proposed in [97] which can detect the ransomware attack before encryption process started. This detection system utilized machine learning algorithm RF for decision making. Detection was performed in two stages by utilizing a combination of signature and behavioral detection. This detection system was evaluated using six evaluation metrics which was distinction of this work. An early ransomware detection system PEDA was proposed in [79] which was able to detect the known and zero-day ransomware attacks before encryption started. This study utilized the signature and behavioral approach to detect the ransomware working in two stages. This study used RF algorithm to perform classification on the fed samples. This system was having many limitations including dependence on the windows APIs and was able to detect only one type of ransomware. This system was not able to detect the ransomware using its native code. This system was not able to fully detect the ransomware attacks instead it was proposed as a supplement detection system. An automated early detection system was presented in [99] which performed testing on machine learning approaches using the pattern extraction. Seven ransomware attacks were considered in the study to test the performance of machine learning approaches. This tool was able to detect the ransomware before encryption starts by using the real logs from Security Operation Centers (SOC). A pre-encryption ransomware detection and prevention system named was proposed in [106]. This system worked in two phases. One phase performed pre-execution by matching the signatures while second phase performed pre-encryption by dynamically analyzing the samples in cuckoo sandbox. This detection system was able to detect known and unknown ransomware before the encryption started. However, it was proposed that the system will have a high false positive rate. Early Detection Studies Utilizing Deep Learning  
Some of the studies in ransomware detection literature, utilized the deep learning methods to detect the ransomware. Some of the studies are described below. A deep learning-based ransomware early detection system named DeepRan was developed in [85] for bare metal server. The detector was able to detect ransomware before it started propagation. This system worked on anomaly detection technique. The normal profile was generated by using the normal activities on the host computer. A comparison was also performed for the developed system and commonly used deep learning models. However, the system was limited in terms of classification as it was trained on logs generated by 17 ransomware families. A ransomware detection system RanStop was proposed in [100] which utilized the hardware assistance to detect the ransomware in 2 ms. This system was able to detect the known and unknown ransomware before the encryption starts. RNN and LSTM were used to train the system to detect the ransomware in runtime fashion. However, this system was limited in term of its functionality and implementation, i.e., required access to sufficient hardware resources. Early Detection Studies Utilizing Both Machine Learning and Deep Learning  
The ransomware detection study that utilized the machine and deep learning algorithms to assist the detection is mentioned below. A hybrid analysis-based ransomware early detection study was presented in [107]. Based on behavior, the machine learning classifier SVM and deep learning classifier LSTM were used to detect the ransomware. File content entropy and I/O activities were observed to extract the features. Data augmentation keyed method was used to synthesize the time series samples for early detection. The samples were executed in bare-metal sandbox for five minutes. Many studies have been conducted on the topic of ransomware detection.