## 6 Research in Ransomware Detection
### Ransomware Analysis
#### 6.1.2 Dynamic Analysis
The machine learning techniques included LR, NB, DT, RF, KNN and SVM algorithms. The effectiveness of shallow and deep networks was evaluated for the detection and classification of ransomwares. API invocations considered to help the evaluation. Experiments were trained using TensorFlow. Experiments were performed by using the cuckoo sandbox. Experimental configuration was performed on linear and radial kernel. I.  Ransomware Dynamic Analysis Studies Utilizing Machine Learning  
Many ransomware detection studies used machine learning technologies to carry analysis. Some of the studies are discussed below. A detection system in [94] performed an in-depth dynamic analysis to collect the system calls. This method selected the API calls that were most relevant in the detection process. This study introduced the refinement process to reduce the API calls from windows platform, hence enhancing the relevancy. Machine learning classifiers were trained on refined system call sequence data. In [20], a system call based ransomware detection method was proposed. Dynamic analysis was performed to extract the related APIs from ransomware, malware, and benign samples. The features that met the fixed threshold were considered for the model training which played important role in the detection process. An analysis based predictive android ransomware detection model was proposed in [119]. The study performed analysis by considering the available solutions for ransomware detection along with analysis on android apps to get the permissions dataset. The apps were scanned by using the weka platform. The predictive model was built by using machine learning classifiers. A machine learning based multi-tier ransomware detection solution was presented in [96]. This detection system worked in three phases analysis, learning and detection. Behavioral analysis was performed to detect the unknown ransomware variants. However, the dynamic analysis was carried out for 5 min which made this system unsuitable for the advanced ransomware detection. An automatic real-time ransomware detection system was developed in [7] which provided the protection to a hospital network. The system was integrated with IntegratedClinical Environment (ICE). This system was able to detect and isolate the victim device to stop the spread of attack to other devices in the network. The system performed detection in 30 s. A network profile was built using ransomware traffic for half hour and the clean network traffic for six hours. A study was conducted in [98] which utilized honeypots to collect the infected files from a host. Infected files were used to perform the dynamic analysis. This was a machine learning study aimed to predict and detect ransomware attacks. However, this study did not discuss details about carried out analysis. An automated ransomware early detection and pattern extraction technique was presented in [99]. This system performed automatic dynamic analysis and extracted discriminating features. Real host logs from security operation centers were used to extract the features. This study did not mention the number of ransomware and normal samples, considered to perform analysis. A crypto-ransomware detection system specifically focusing on lucky ransomware was demonstrated in [101]. Network activities were analyzed using dedicated testbeds. Features were extracted from the network traffic observed at two different levels. Network packets and flow were monitored to capture PCAP files which later used to extract network features. A ransomware detection method was proposed in [102] which utilized the process mining technique along with machine learning algorithms. Feature extraction from process mining was performed by using a fuzzy algorithm-based tool disco. Samples were run in the virtual machine and event logs were generated. A process monitoring tool was also used to monitor the registry activities and file system. However, details about analysis performed were not explained in the study. A two-stage ransomware detection model was built in [89].