## 3 Different Aspects of Ransomware Studies
### Ransomware Detection Approaches
#### 3.8.1 Misuse based Ransomware Detection Approaches  
In misuse-based ransomware detection, the signatures of already discovered ransomware are used to draw the conclusion for available threats. It matches the encountered threat with known and available signatures to make decision. Misuse detection is further classified into two categories, i.e., structural or signature and behavioral [24]. A summary of ransomware detection approaches is presented in Table 1.  
Signature based Detection Approaches  
In signature-based detection approach the patterns or codes of already available threats are compared with the under examine code. One of the limitations of this approach includes the outdated samples. New variants are developing with passage of time which required a periodic update to the available ransomware collection. This periodic updating caused overhead [72]. A signature based detection technique was proposed in [8]. This detection approach utilized formal methods for the detection of ransomware in the mobile devices. This detection system inspected the malicious behavior at the bytecode level. In [57], an android based ransomware detection system was presented named as R-PackDroid. This system ran the static analysis using RF a supervised machine learning classifier to categorize the applications in ransomware, generic malware and trusted by using the system API packages. This system also confirmed the samples uploaded on VirusTotal with low confidence. However, this system was not able to detect the application that load the feature code during execution. The system could not detect the class that are fully encrypted. A static analysis-based ransomware detection method was proposed in [73]. This system was able to detect the ransomware which can fingerprint the environment. The work was proposed for the binary and multi-level classification and to fill up the gap for dynamic analysis limitations. Static analysis was performed on opcodes, based on text analysis along with machine learning algorithms. Contextual information was extracted to perform the static analysis in [74]. It was a deep learning-based model which performed the static analysis on N-gram of opcodes. Self-attention mechanism was used on the semantic information to capture the rich context. This system was able to detect the ransomware which could fingerprint environment. However, this approach did not ensure the accuracy due to hard handling of advanced packing techniques adopted by the new variants of ransomwares. Behavioral based Detection Approaches  
In the behavioral based detection approach the under-examination samples are executed in the controlled environment to monitor its behavior. The detection is performed in accordance with the behavior, shown by the subjected sample(s). The study in [9], described an early warning detection system which monitored the ransomware behavior on the user files. This system was run for 20 min which made it unsuitable for the ransomware detection due to long time. This detection system was also not able to detect the zero-day attacks. In [49], a real time detection approach was presented which provided early detection. A study was carried out on locky ransomware. A decoy file technique along with process monitoring was used to implement the detection system. A depth first search and recursive approaches were considered for the file traversing. Decoy files were placed in every directory. When a malicious process operated the decoy file, process monitoring module monitored the process. If malicious activity was observed, the process was referred to the user for decision about execution continuation. A ransomware detection approach called Self Defensible SSD was proposed in [50] utilized storage devices for detection purpose. Storage access activity was transparently monitored to detect the ransomware and once a ransomware was detected, the garbage collector performed the backup work to retain the original data. This approach could perform the recovery of original data without the decryption key.