# Artificial Intelligence in Cybersecurity: A Review and a Case Study
## 4 Ransomware: A Growing Threat in the Cybersecurity Landscape
By acknowledging its limitations and adapting applications to address these issues, researchers can leverage the strengths of DL to bolster ransomware detection capabilities [16; 20; 21]. \begin{table}
\begin{tabular}{c c} \hline
**Year** & **Ransomware** \\ \hline
1989 & AIDS Trojan \\
2012 & Reveton \\
2013 & CryptoLocker \\
2014 & CryptoWall \\
2015 & TeslaCrypt \\
2016 & Locky \\
2017 & WannaCry \\
2018 & SamSam \\
2019 & Ryuk \\
2020 & Maze \\
2021 & REvil/Sodinokibi \\
2022 & Royal Ransomware \\
2023 & LockBit Ransomware \\ \hline \end{tabular}
\end{table} 
Table 1: Brief chronology of major ransomware. In response to the ever-sophisticated social engineering tactics employed by cybercriminals and the limitations of existing tools in detecting novel ransomware variants, a recent study by the authors of [22] proposed a novel framework called \"RTrap\". This framework utilizes machine learning to generate decoy files strategically placed throughout a system. By acting as bait, these deceptive files lure ransomware into targeting them, triggering a lightweight monitoring system that continuously tracks file activity. Evaluations conducted by the study's authors demonstrate RTrap's effectiveness in ransomware detection, achieving a high success rate with a minimal average loss of only 18 legitimate user files per 10,311 files. Building upon the work presented in [23], the authors propose Ransommal, a novel framework that leverages reinforcement learning (RL) to endow existing ransomware with the capability to dynamically adapt its encryption behavior. This dynamic adaptation gives ransomware a powerful ability to evade detection by security solutions. RansomAI integrates an agent that works by learning the optimal combination of encryption algorithms, rates, and durations. In such use, the system balances maximizing data encryption with minimizing detection by a sophisticated defense mechanism that employs device fingerprinting. To validate RansomAI's effectiveness, the authors deployed it within Ransomware-PoC, infecting a Raspberry Pi configured as a sensor. Experiments using Deep Q-Learning for representation and Isolation Forest for detection showed that their system performed the detection process quickly, within minutes, with an accuracy exceeding 90%. Nonetheless, further evaluation is planned to assess RansomAI's generalizability across diverse devices and its efficacy with various malware samples. Effective malware protection requires considering a comprehensive set of parameters. A robust defense strategy integrates diverse methods that address these parameters simultaneously. Focusing on a single parameter creates vulnerabilities that malware can exploit. This is particularly critical when dealing with the varied threats posed by ransomware. ML algorithms offer a powerful approach to detecting ransomware patterns due to their ability to handle diverse data points. However, effective implementation requires a layered development process. Each layer's effectiveness must be rigorously evaluated and deficiencies addressed. Early detection and understanding of malware patterns during development can be highly advantageous. User awareness plays a vital role in ransomware defense. Training programs that educate users on ransomware fundamentals and current defense systems can significantly improve organizational preparedness. This empowers users to contribute to the overall security posture and reduce the risk of successful attacks.