# Adaptive Ransomware Detection Using Similarity-Preserving Hashing
## 2 Literature Review
### Hashing-Based Methods  
[PERSON] et al. [16] introduced a real-time intrusion detection system for industrial control systems (ICSs) that incorporates hashing as an attribute to monitor. The system stores information such as the file name, permissions, last modification date, and file content hash, among other attributes. Furthermore, the system is event-based; it does not continuously run and instead only triggers checks in the case of file changes by utilizing Windows PowerShell cmdlets, which leads to a reduced performance overhead. However, their proposed system stores the full hash of the file, which may introduce scalability issues, especially for larger files, and which may have a great impact on ICSs, which are performance-critical systems. Furthermore, [PERSON] et al. [17] proposed a system for data backup with ransomware protection. Initially, the system populates a database with hashes of system files from a trusted online application programming interface (API) or from the current system state, \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Reference** & **Method** & **Environment** & **Remarks** \\ \hline [PERSON] et al. & & Windows industrial control systems & Detects any change, not specific to ransomware \\ \hline [PERSON] et al. [17] & Hashing and machine learning & Backup files & N/A \\ [PERSON] et al. [18] & Hashing and FAISS (vector quantization) & Backup files & N/A \\ [PERSON] et al. [19] & Fuzzy hashing on the ransomware & N/A & Dunn index but does not detect new versions \\ \hline [PERSON] et al. [20] & Behavior-based (Windows API, machine learning) & Windows & Looks for feature optimization \\ [PERSON] et al. [21] & Behavior-based (Windows API) & Windows & Feature selection analysis, peak accuracy = 98.7\% \\ \hline [PERSON] et al. [22] & Signature-based combined with behavior-based & Windows API & Detection rate of 99\%, but works for Windows only \\ \hline [PERSON] et al. [23] & Behavior-based & Machine learning from file entropy & A 99\% accuracy rate, but can be bypassed with entropy-avoiding techniques \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Literature review summary. which is considered the baseline for safety. Following that, the system continuously monitors critical system files and checks for signs of compromise (e.g., ransomware encryption); this is done by checking different file characteristics, including the file hash, and comparing them with the baseline. If a file is deemed safe, it is uploaded to the backup site; however, in cases where a file is detected as corrupted, then the file is restored by downloading the latest safe version of the file onto the backup site. The system utilizes machine learning (ML) techniques such as K-nearest neighbors (KNNs) to check whether the file's characteristics are similar enough to the safe, backed-up version. Building on their previous work, a subsequent study by [PERSON] et al. [18] improved upon the proposed data backup system by utilizing Facebook AI Similarity Search (FAISS). Instead of using traditional machine learning methods, the new approach uses FAISS for hash comparison. \"Fails is a library for efficient similarity search and clustering of dense vectors\" [24]. [PERSON] et al. use the library by generating vectors for the hashes, which allows for rapid hash matching. Additionally, they perform a quantization of the vectors using the product quantization (PQ) method, which further improves performance and reduces the time overhead. [PERSON] et al. [19] present a fuzzy hashing-based approach to ransomware detection with a focus on malware sample identification. The two-stage method uses hashing to identify ransomware samples. Initially, fuzzy hashing is used to capture similarities between ransomware samples and generate similarity scores. Following that, clustering is used to group together similar samples.