# Opportunities for Early Detection and Prediction of
## 2 Related Works
### Research Related to Ransomware Countermeasures
#### 2.3.1 Ransomware Prevention  
Typically, studies that focus on prevention identify the various factors and parameters that can influence the quality of the preventive measures [31]. The performance of prevention frameworks depends heavily on quality factors. Predictions can also be used as a proactive measure that improves prevention capabilities. Although several studies developed prediction models for malware attacks, they use historical data as the basis for prediction [32; 33; 34; 35]. While this approach may be suitable for systems whose behavior is static, it cannot be applied for ransomware attacks as the behavior is dynamic due to obfuscation strategies such as polymorphism and metamorphism employed by attackers. In addition, the existing predictive models are built out of the context from overseeing the situation in which the ransomware attacks take place. In this section, a dozen or more studies related to ransomware prediction are identified and discussed.  
The factors influencing ransomware threat avoidance were explored by [36]. This study exposed the interactions between several factors such as the subjective norm, the attitude towards knowledge sharing, the experience of threats, and how such interactions affect threat avoidance behavior. Moreover, this study identified the cascading effect of the interaction of factors that act as a chain of nodes whose one node influences the proceeding node and is influenced consequently by its preceding node, and so forth. The study focused on college students within the United States. An empirical study to assess the ransomware-related severity factors was conducted by [37]. The study investigated the effect of a set of factors on the degree of severity. Among the studied factors are the organization's size, security posture, propagation class (a.k.a. the degree of ransomware sophistication), and type of attack target. An impact assessment was carried out involving several items such as the business continuity disruption timeframe, recovery time, affected devices, and information loss.  
A set of ransomware success factors were proposed by [38], including anonymous payment methods, the adoption of system-owned cryptographic libraries, and easy-to-use ransomware development kits. However, all previous studies approached the factors related to ransomware attacks in isolation from the targeted environment. That is, those factors were investigated in general without considering the operational environment. This makes the findings and proposed hypothesis difficult to reflect on a particular scenario or system. For SCADA systems, several ransomware attacks' key success factors have been investigated [11]. The study tried to focus on the factors related to the operational aspects of the system. Resource limitation and incompatibility between the SCADA system and security measures and security protocols were among the issues that were highlighted.  
The study conducted by [39] investigated the interaction between the users, anti-virus software, and malware. An empirical experiment has been conducted to measure several factors that influence the spread of malware on victims' devices. The study concluded that the use of the Internet, peer-to-peer applications, and computer expertise are found to be more influential in the rise of malware attacks. The relationship between user activities and malware infections was also investigated by [40]. Routine activity theory was used to measure to what extent the convergence of motivated attackers and vulnerable targets could increase the likelihood of malware infections. The study concluded that the legitimate use of computers has a weak correlation with a malware infection. Such correlation becomes stronger when victims use illegitimate (pirated) software.