# Opportunities for Early Detection and Prediction of
## 2 Related Works
### SCADA Ransomware Surveys and Challenges  
Ransomware is a popular research topic and several surveys have been conducted to study its various aspects. The survey conducted by [18] examines SCADA systems' architecture, vulnerabilities, and attack vectors due to TCP/IP network integration, and analyzes ransomware, its phases, and encryption techniques. It establishes a risk assessment for ransomware injection in SCADA systems, noting that budget constraints often result in inadequate isolation and therefore exposure to threats. The study highlights the potential damage caused by ransomware attacks on critical infrastructure and recommends prioritizing ransomware protection in risk management and incident response plans. However, the survey neither discussed the solutions proposed for preventing and predicting ransomware attacks nor highlighted the effect of the situation and context in which the attacks occur. Likewise, ref. [19] examined the security vulnerabilities of SCADA systems and categorized the threats. It reviewed SCADA systems' architecture, vulnerabilities, attacks, intrusion detection techniques, and testbeds as well as proposed an attack taxonomy based on specific criteria. Moreover, the survey discusses the general threats and does not discuss predicting the likelihood of a ransomware attack.  
Another survey [20] provides an analysis of ransomware attacks pertaining to PCs/ workstations, mobile devices, and IoT/CPS platforms. This survey covers studies completed from 1990-2020, which offers insights into ransomware evolution, key components, a taxonomy of significant ransomware families, and an extensive overview of countermeasures, including analysis, detection, and recovery across various platforms (i.e., not just SCADA). Similarly, [21] offered a survey on the evolution, prevention, and mitigation of ransomware in an IoT context, providing insights into IOT ransomware evolution. The authors strived to dissect the various aspects of attacks, including ransomware strains, current research, prevention, and mitigation techniques, handling affected machines, deciding on ransom payment, and future trends in IoT ransomware propagation. However, solutions related to the early prediction of ransomware were not discussed in either survey.  
The investigators in [22] have noted recent progress in analyzing, detecting, and preventing ransomware attacks. They discuss ransomware detection and prevention methods, and the testing of ransomware samples, and have proposed a new experimental ransomware detection add called AESthetic, which is incorporated into antivirus software for the purpose of preventing such attacks. Their survey analyzes the effectiveness of countermeasures and identifies several future research challenges. Another survey by [23] compares and classifies recent ransomware detection techniques and their respective decision-making procedures to distinguish between benign and malicious strains. Both studies focused only on the detection and prevention of ransomware without discussing the early prediction of such attacks. Consequently, the need to better define this gap in terms of the existing literature discussing the likelihood of an attack given the contextual circumstances is needed. Our paper strives to investigate how situational awareness, including context, can be incorporated into those solutions as an additional layer.