# Opportunities for Early Detection and Prediction of
## 2 Related Works
### Research Related to Ransomware Countermeasures
#### 2.3.2 Ransomware Prediction and Detection  
Organizational and managerial factors are not the only aspect that can be explored for situational-awareness-based protection against ransomware attacks but also the system's operational parameters. That is, the data collected from the running process of ransomware can be combined with the organizational and managerial data so the model can predict based on the behavior of both the ransomware and the system. This makes the model situationally aware of future attacks that consider not only the development of ransomware behavior but also the system's vulnerabilities. Therefore, the model can adapt to the operational and behavioral changes of the ransomware and target system. Several studies were conducted to investigate the use of intelligent prediction engines to predict potential malware and ransomware attacks. In the study [41], they used the generative adversarial network (GAN) to predict future malware variants. The GAN was used to generate new malware samples based on existing ones. The data were generated by observing existing malware signatures and producing similar signatures. The signature is derived from the static analysis of malware payloads. The MalDeepNet [42] is a model constructed to predict the behavior of malware and construct artificial patterns that represent the trend of malware behavior. The new patterns are then added to the existing malware dataset, which was used to train a cluster-based detection engine. Likewise, MalGAN [43] is a GAN-based malware generator that is used to develop malware black-box attacks. MalGAN utilizes a generator to create the malware samples and a substitute detector to train the black-box malware detection system. A generative network is trained to minimize the generated adversarial samples needed to produce the specific malicious probabilities that would be predicted by the substitute detector. Another study by [44] conducted a behavioral analysis of the ransomware attack process and developed a model that predicts the future behavior of the malware. The study relies on data related to the attack process, file system, persistence, and network analysis. The model was built using supervised machine learning. The idea is to watch, learn, and predict how the malware will evolve toward achieving its goal with very little data. However, the study is limited to data that represent the previous attack behavior regardless of the context in which the attack has taken place. This adversely affects the model's accuracy when dealing with sophisticated and targeted attacks that change their behavior according to the context. A logistic regression prediction model [45] was developed to circumvent the new malware attack. The model was trained using a dataset of previous malware infections. The model introspects the patterns in the data and analyzes the progression of the attack behavior. Likewise, the light gradient-boosting decision tree was used by [46] to predict future malware attacks on cloud systems. The model uses malware behavioral data to train the decision tree classifiers. Similarly, the study conducted by [47] developed a regression-based neural network model to forecast short-term ransomware behavior based on historical time-series data. These models only focus on data related to processing operations, but the context in which the process was running has been ignored. A predictive model [48] for ransomware attacks on IoT devices was conducted using the context ontology for feature extraction [49]. The use of contextual data helps to reduce the computational complexity needed, which makes it suitable to run on resource constrained IoT devices. The context ontology focuses on a subset of known ransomware attack vectors based on the assumption that the targeted devices are of the IoT type. However, relying only on contextual data for lightweight modeling is not enough to capture the characteristics of the evasive malware as it drops the behavioral data which is imperative for predicting the future behavior of the malware.