## 6 Research in Ransomware Detection
### Ransomware Analysis
#### 6.1.2 Dynamic Analysis
In the first stage the model collected windows API calls by performing the dynamic analysis in cuckoo sandbox. In second stage Markov chain model along with machine learning algorithm was utilized to classify the sample into benign or ransomware. A model that extracted the runtime features and perform ransomware detection was proposed in [112]. Model performed detection during execution by scanning the API calls, registry activities, network, and file system. Behavior based features were extracted from API calls. Online machine learning classifiers were used to classify the samples. A novel early detection system to detect the ransomware was presented in [95]. This detection system addressed the limitation of existing ibagging and bagging++. This system dealt with the limitation of little data availability in early stages of ransomware attacks by integration of ibagging and enhanced semi-random subspace selection techniques. Informative features subsets were built by incrementally dividing the features extracted from the dynamic analysis. The produced subsets were noise free and divergent with optimal selected features. An upgraded ransomware detection model was presented in [118] which grouped the monitoring model and registry key operations. It was a behavioral detection model which run the dynamic analysis for maximum 60 min in cuckoo sandbox. It was a forward-looking monitoring system which utilized machine learning techniques for exploring and comparing the feature space. This system also provided the file backup on windows system. I.  
Ransomware Dynamic Analysis Studies Utilizing Deep Learning  
The ransomware detection studies which made the use of deep learning algorithms for the analysis and classification of ransomware are briefly summarized below:  
A detection study named RAPPER was presented in [81] which worked in two modes, i.e., offline and online. This detection and prevention study carried out the dynamic analysis by using the sandbox. Ransomware and benign samples were observed for 10 ms to generate the profile for the normal processes. Datasets was generated by observing the system activities for 10 ms which was the limitation of the system. This detection system utilized LSTM, a deep learning autoencoder and fast Fourier transformation to detect the malicious activity. In [62], a fog layer based ransomware detection system was presented. Dynamic analysis was performed on ransomware samples from different families. System utilized the deep learning techniques for the detection of unseen ransomware families. In this study the dynamic analysis was performed for only 10 s, making this system unsuitable for the detection of ransomware using evasion techniques. A ransomware detection model for industrial IoT, utilizing the dynamic analysis method was proposed in [89]. Discriminating features were extracted from the API by performing the dynamic analysis. Two autoencoders named classical autoencoder and variational were used to detect the behavioral characteristics of the samples. A deep neural network classifier classified the program into ransomware or normal category. A ransomware detector utilizing the deep learning was developed in [85] which was able to detect the ransomware events for bare metal server. The detector was named DeepRan that was cable of detecting the ransomware before it starts encryption in a network environment. Normal host logs and ransomware event logs were generated which then utilized to train the deep learning classifier. However, this study could not classify the zero-day ransomware attacks as the classifier was trained on 17 ransomware families. A ransomware detection study in [90] utilized the variational autoencoder, an artificial neural network architecture to classify the fed sample in ransomware or benign. In the study it was mentioned the detection model was trained on the dynamically analyzed data from a set of 1524 samples of ransomware and benign. However, no details of analysis were presented.