## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.3 Detection
A class frequency and non-class frequency method was used to extract the API calls which helped to detect the ransomware and malware accurately. Six different machine learning algorithms including RF, LR, NB, SGD, KNN, and SVM were employed in this study. The detection model was intended to perform a performance comparison of CF-NCF and TF-IDF. A predictive ransomware detection study utilizing the machine learning was proposed in [119]. Study included two types of analysis. One analysis was carried out on available ransomware detection studies while other analysis was carried out on android ransomware and benign apps. These apps were scanned to collect the list of requested permission lists. Based on permission, the prediction was made. A machine learning based detection solution was presented in [96] which utilized decision tree and naive bayes algorithms. First prediction about ransomware was done using decision tree while other prediction was reinforced by the naive bays decision. This system was able to detect the zero-day ransomware attacks. System has limited functionality as the analysis on the fed samples was done for only 5 min. An integrated clinical environment real-time detection system was developed in [7] for the hospital. This system was able to detect and mitigate the ransomware attack effects using SDN. This system was able to detect and isolate the ransomware attacked device to stop the attack in the first place. Machine learning algorithms OCSVM, RF, NB were used to perform detection in 30 s.  
An android ransomware detection study was presented in [126]. This study utilized DT, RF, AdaBoost, and gradient boosting machine learning algorithms. Two experiments were carried out on two different datasets differing in number of attributes considered. In one experiment five attributes were considered while in other ten attributes were considered. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline  & \multicolumn{4}{c}{**Counteraction Studies**} \\ \hline
**Sr\#** & **Study** & **Detection** & **Prediction** & \multicolumn{2}{c}{**Prevention**} \\ \cline{3-6}  & **Study** & **Detection** & **Prediction** & \multicolumn{2}{c}{**Proactive**} & **Reactive** \\ \hline  
\hline \end{tabular}
\end{table} 
Table 5: Summary of ransomware counteraction studies. Data splitting in training and testing datasets were performed by using the Multinominal NB, Gaussian NB, and Bernoulli NB. A supervised machine learning based prediction and detection study was explored in [98]. This study utilized the honeypots for detection of ransomware. A machine learning algorithm SVM was used to classify the ransomwares. The study did not highlight the dynamic analysis work properly. A ransomware detection study was demonstrated in [101] which focused on analyzing the network activity. Locky ransomware was used to see its behavioral analysis and effects on the computer system. This study utilized four machine learning classifiers RF, LibSVM, random tree, and Bayes Net to perform the classification on two different levels, i.e., network packets and network flow. Network analyzing features were extracted from packets and flow of network. In an android based ransomware detection study [32] the effectiveness of machine learning algorithms was evaluated. This study utilized a dataset CICAndMal2017, created by using the real android smartphones. Machine learning classifiers DT, RT, RF, NB, KNN, and SVM were trained and evaluated on two different dataset one containing 20% data from each family and second dataset contains whole ransomware dataset. Process mining technique was used in [102] to detect the ransomware in 10 s. Event logs were utilized to find out number of occurrence of an event to detect the ransomware activity. Four different machine learning algorithms J48, NB, RF, and LR were used to perform classification. Two different tools disco and process monitoring were used to extract features from event logs and monitor the process for the ransomware detection respectively.