## 11 Conclusions  
Summarizing the results achieved in the research phase and the position expressed in the discussion part, it can be stated that the current trend is that there is a great need for a tool that can fill the gaps left by the financial difficulties of complex security systems, and that can work with and complement existing security solutions to avoid situations where, for whatever reason--but mostly the human factor--we find ourselves in the crosshairs of a ransomware attack (e.g., antivirus turned off, unknown hardware connected to the network, RDP).  
The aim was to plan and develop an infrastructure that can protect data even in the event of ransomware attack, that can signal/warn about any potential attacks and can be built and maintained in a cost-effective manner. As the attack strategies of ransomware are constantly changing and becoming more and more sophisticated, it will be a challenging task to objectively assess the effectiveness of the system. Testing will take place on an infrastructure consisting of physical workstations, virtual machines and containerized services, by using clients infected with the most common types of ransomware. In order to achieve proper efficiency, the system must be able to recover encrypted or deleted data, or data made unusable without any arising problems in a smooth way, and must indicate the presence of malicious code with high accuracy (C2 server, file operations, outbound data flow, data traffic leaving the network).  
Based on the survey of small and medium-sized companies, it can be clearly stated that there is a need for an improved, cost-effective anti-ransomware solution that specifically addresses the interests of this group of users. Implementing the solution is an increasingly urgent task, as cybercrime poses more and more challenges to users on a daily basis--all this compared to the fact that data protection has become a primary task in business and private communication and in the day-to-day operation of online space. The first step in the defense against sophisticated ransomware-type attacks is the implementation of the presented automated solution, which is able to detect and analyze rapidly changing attacks with special automation and protect the vulnerable infrastructure.  
The following are available online at [[https://www.mdpi.com/article/10.3390/app11136070/s1](https://www.mdpi.com/article/10.3390/app11136070/s1)]([https://www.mdpi.com/article/10.3390/app11136070/s1](https://www.mdpi.com/article/10.3390/app11136070/s1)).  
Conceptualization, V.S., G.A. and A.D.; formal analysis, V.S., G.A. and A.D.; investigation, V.S. and A.D.; methodology, V.S., G.A. and A.D.; project administration, V.S. and A.D.; resources, V.S. and G.A.; supervision, V.S.; validation, G.A.; writing--original draft, V.S., G.A. and A.D.; writing--review and editing, V.S., G.A. and A.D. All authors have read and agreed to the published version of the manuscript.  
This research received no external funding.  
Not applicable.  
Data Availability Statement: Data is contained within the article or supplementary material.  
The authors declare no conflict of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript, or in the decision to publish the results.  
The following abbreviations are used in this manuscript:  
\begin{tabular}{l l} COTS & Component/commercial off-the-shelf \\ IDS & Intrusion detection system \\ IPS & Intrusion prevention system \\ APT & Advanced persistent threat \\ MITM & Man in the middle \\ C2 & Control and command \\ GDPR & General Data Protection Regulation \\ ZFS & Zettabyte file system \\ LotL & Living off the land \\ IoT & Internet of Things \\ IoC & Indicators of an incident \\ RDP & Remote desktop protocol \\ DNS & Domain name system \\ iSCSI & Internet small computer systems interface \\ \end{tabular}