## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.3 Detection  
These studies are aimed at finding the ransomware attack during or after it takes place. There are two approaches for ransomware detection, i.e., structural, and behavioral [24; 25]. A mobile ransomware detection study was proposed in [8]. This study detected the android ransomwares by using bytecodes and remove them from device. However, this study has limited scope as the samples were considered from top 10 ransomware families at that time. Secondly this approach lacks in disassembling all selected samples. In [57], a lightweight an android ransomware detection system named R-PackDroid was proposed. This system utilized the supervised machine learning with system API calls to categorize the samples. The fed samples were labelled as ransomware, malware, or trusted application. It worked well for the detection of already discovered ransomware. However, this system was not accurate as it did not detect the code during execution. This system was not fully developed for android systems. A deep learning based ransomware detection method was proposed in [48] which utilized Deep Belief Network. This detection system was designed for the embedded systems and IoT devices. This method worked by storing the bit streams in the memory. This system performed behavioral based detection by using the memory assisted stochastic dynamic fixed-point arithmetic. A windows based detection system using dynamic analysis was presented in [14] named as UNVEIL. The system detected the ransomwares by observing the changes on the desktop using similarity score of desktop screenshots. It created the artificial environment using sandbox for the detection purpose and observed how ransomware interacted with environment. This system also discovered the previously unknown zero-day ransomwares. This system performed detection from live and real world fed data. This system worked by attaching to the file system drivers focusing on write and delete requests. This system run within kernel for the detection purpose. This system specifically detected file locker and screen locker ransomware. A ransomware detection study for Cryptowall ransomware was presented in [76]. This detection system performed dynamic analysis by implementing the honeypots. The network traffic was observed to find out the malicious behavior. Once the malicious behavior found, the infected system was isolated. A ransomware detection system was developed in [82] which worked in two modes, i.e., user mode and kernel modes. A normal profile was built by collecting the normal activities data from 50 workstations. However, this detection system did not ensure the complete protection of the user data from the occurrence of the ransomware attack. In [93], a ransomware detection and prevention approach was presented for high survivable ransomware. User has right to abort the suspicious connection hence stop the encryption process. This model worked in two phases. One phase detected the connection and other phase brake the malicious connection on the user command. A ransomware detection study was introduced in [61]. This detection technique used PSO and SVM to develop an evolutionary machine learning based approach. This system was developed for android platform that deals with imbalanced data. Feature selection of imbalanced data and optimization were point of focus of this approach. Ransomware counteraction studies are summarized in Table 5.  
A. Ransomware Detection Studies w.r.t. Pre and Post Encryption  
In this study ransomware detection studies are categorized according to the available literature, i.e., two major categories, which are conventional and early detection. Conventional and early detection studies which utilized the machine and deep learning technologies for the ransomware detection purpose are considered in this paper. An overview of the detection studies with respect to encryption timeline and use of machine and deep learning is given in the Figure 6.  
A real-time API based machine learning ransomware detection model was proposed in [20].