## 7 Research Direction  
In this paper a brief survey about the machine and deep learning technologies used in the field of ransomware detection was presented. After surveying the available literature, few research directions are highlighted below as there is still room of improvement in the field of ransomware detection. Several open issues that need further research are listed to improve the efficiency of the ransomware detection systems. 1. Dealing with computational and time complexities: The detection systems should be developed considering the computational overhead. A system should detect the ransomware attack in no time to make it valid. There should be detection systems with less time complexities. Specially for the devices with resources constrains, i.e., IoT and embedded systems. 2. Dealing with hardware complexities: Most of the developed systems are hard disk supported having high RAM. System with limited hardware should also considered while developing a detection system. The more complex detection systems will incur the high cost. Some of the available solutions are also hardware dependent requiring advance hardware. 3. Evasion and obfuscation: Ransomware development and detection is a non-stationary field which keep on evolving with time. Developing ransomware detection solutions should cope with ransomware evasion and obfuscation techniques. System which can deal with evasion and obfuscation will be more reliable with high accuracy and low false alarms. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & & \multicolumn{5}{c}{**Detection Studies w.r.t. Pre and Post Encryption**} \\ \hline \multirow{2}{*}{**Sr#**} & \multirow{2}{*}{**Study**} & \multicolumn{2}{c}{**Conventional**} & \multicolumn{2}{c}{**Early/Pre-Encryption**} \\ \cline{3-8}  & & **ML** & **DL** & **ML and DL** & **ML** & **DL** & **ML and DL** \\ \hline
16 & [99] & & & & ✓ & \\ \hline
17 & RanStop [100] & & & & ✓ & \\ \hline
18 & [101] & ✓ & & & & \\ \hline
19 & [91] & & ✓ & & & \\ \hline
20 & [32] & ✓ & & & & \\ \hline
21 & [102] & ✓ & & & & \\ \hline
22 & [127] & ✓ & & & & \\ \hline
23 & [103] & ✓ & & & & \\ \hline
24 & [104] & & & ✓ & & \\ \hline
25 & [105] & ✓ & & & & \\ \hline
26 & [106] & & & & ✓ & \\ \hline
27 & [88] & ✓ & & & & \\ \hline
28 & [107] & & & & & ✓ \\ \hline
29 & [108] & & ✓ & & & \\ \hline
30 & [16] & & ✓ & & & \\ \hline
31 & [109] & & ✓ & & & \\ \hline
32 & DeepGuard [110] & & ✓ & & & \\ \hline
33 & DRDT [113] & & ✓ & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: _Cont._Real-time system: Most of the available studies in the ransomware detection are empirical and proposed. A real-time detection system with minimal time to response to the attack is required. Failing to provide the real-time detection will lead to irreversible encryption of some or all the data. 5. Distributed environment: Most of the available ransomware detection solutions are developed for the desktops and mobile devices. There should more research on the spread of ransomware attack in a distributed environment. In a distributed network environment, most damage can be caused just by attacking a single device. 6. Scalable and adaptive: The developed solutions for the ransomware should be scalable so that they can deal with detection on multiple machines, i.e., improving the detection capabilities. The new ransomware detection model should be scalable to the advance ransomware and newly updated datasets. With the passage of time new and more sophisticated ransomware samples are being developed. These advanced ransomwares can be dealt well with the adaptive and scalable ransomware detection model. 7. Forensic by design concept: The integration of forensics by design and ransomware detection system would reduce the loss. Use of forensic by design will help to detect, mitigate, and roll back the ransomware attacks. This will also help in forensic investigation. 8. Use of fuzzy modelling: With the evolution of ransomware attacks there should be an automatic computation system for the ransomware.