# A Deep Learning Framework for Enhanced Detection of Polymorphic Ransomware
## 2 Related Work  
The operational benefits of SCADA system deployment are undeniable; however, this proliferation has created substantial cybersecurity challenges [23]. SCADA systems are inherently complex, comprising diverse components and protocols that frequently exhibit interoperability issues and operate under disparate standards [24]. Moreover, their growing connectivity to public networks, intended to facilitate interoperability, dramatically increases their vulnerability to cyber threats. These threats include malicious software specifically crafted to steal sensitive information, gain unauthorized access, and disrupt vital industrial processes, as shown in Figure 1[23, 25].  
Malicious software has evolved significantly since its first appearance in the late 1970s [26]. Advanced strains, such as viruses, worms, Trojans, and ransomware, now pose significant threats [25, 27, 28]. Ransomware stands out as a particularly insidious threat, leveraging encryption to render data inaccessible and exploiting victims' fear of critical resource or sensitive information loss to extort ransom payments [29, 30, 31, 32, 33, 34]. Ransomware attacks are often irreversible because they use encryption, and their financial profitability motivates adversaries to develop increasingly advanced versions [13, 35]. Moreover, the financial impact of ransomware attacks is substantial, with ransom demands ranging from USD 300-USD 700 for individuals and USD 10,000-USD 17,000 for enterprises [36]. In some cases, victims have paid as much as USD 400,000 in a single month [37], and the FBI's Internet Crime Complaint Center reported losses of approximately USD 18 million from ransomware attacks between April 2014 and June 2015 [38, 39].  
Probably the most famous attack, although not targeted at ICSs, in recent memory (Feb. 2024) was the (Russian speaking) hacker gang known as BlackCat (also as ALPHV), receiving a payment of USD 22 million via Bitcoin. Though the victims made the ransomware payment, UnitedHealth Group CEO [PERSON] shared on 1 May 2024 to Congress that Change Healthcare did not obtain its data back. Total damages are estimated to be almost USD 3B (BlackCat operates as a Ransomware-as-a-Service (RaaS) platform, allowing other cybercriminals to use its ransomware in exchange for a share of the profits. While most RaaS models let affiliates retain about 70% of their earnings, BlackCat offers a more generous share, allowing affiliates to keep 80-90% of their profits (see \"Breaking Down the BlackCat Ransomware Operation,\" _CIS_, 7 July 2022. Available: [[https://www.cisecurity.org/insights/blog/breaking-down-the-blackcat-ransomware-operation](https://www.cisecurity.org/insights/blog/breaking-down-the-blackcat-ransomware-operation)]([https://www.cisecurity.org/insights/blog/breaking-down-the-blackcat-ransomware-operation](https://www.cisecurity.org/insights/blog/breaking-down-the-blackcat-ransomware-operation)) (accessed on 1 March 2025), and a USD 10M + USD 5M = USD 15M reward is being offered). Though this was not an attack on ICSs, the attack is estimated to have resulted in a total impact of USD 2.87 billion, including USD 1.7 billion in direct response costs. Change Healthcare covers about 50% of medical claims in the US for around 900,000 physicians, 33,000 pharmacies, 5500 hospitals, and 600 laboratories. This incident underscores the catastrophic potential of single-point-of-failure systems, a stark warning as our world increasingly relies on operational monopolies. Refer to Appendix A for more detailed discussion of the methods and tactics for this and the other attacks mentioned in this article).  
Given the escalating threat of ransomware, understanding the factors driving attack success is crucial. This research leverages the developed framework to analyze these factors, specifically within SCADA system attack models. By elucidating the tools and mechanisms employed during attacks, the model facilitates the development of effective security measures tailored to safeguard SCADA environments [40; 41; 42].