# Opportunities for Early Detection and Prediction of
## 2 Related Works
### Ransomware Attacks on SCADA  
Ransomware targets a broad spectrum of sectors, including critical infrastructure such as transportation, telecom, logistics operations, public agencies, and healthcare [24]. Moreover, with the recent disruption of Colonial Pipeline's 100 million gallons of daily fuel supplies and the halting of JBS's beef-processing operations, ransomware attacks hit heavily on industrial sectors causing major losses to the victims and consumers.  
By utilizing the cryptography-related application programming interfaces (APIs) embedded into the operating systems, ransomware can efficiently run in various environments with minimal memory and processing resources [25]. Different ransomware categories exhibit various behaviors related to encrypting data and locking services. Such encryption can be easily performed using the libraries and functions embedded in the underlying operating system [26]. Therefore, the distinction between ransomware-based encryption and innocent encryption is challenging as they both use the same libraries and APIs.  
Based on the targeted resource and the attack mechanism, ransomware can be classified into two categories, namely, locking ransomware and crypto-ransomware [27]. While the former disables one or more key services provided by the targeted system, the latter encrypts the data and/or user-related files. Therefore, the key difference between ransomware and traditional malware is the use of a system's own component (like cryptographic routines or hardware) to attack another component (like the file system) [12]. This makes it easy for ransomware developers to create unbreakable, sophisticated programs with little effort, which explains the trend of ransomware attacks in recent years.  
Unlike traditional malware and cyberattacks, thwarting ransomware needs to be more proactive due to the irreversible damage that it may inflict on the victim's data [28] and operations. While the malware effect could be reversed by simply removing the malicious software, the ransomware's encrypted data cannot be accessed without the help of the ransomware's owner [10]. Therefore, it is more feasible to be proactive and prevent the attack in the first place. As prevention needs the involvement of the system user (i.e., victim) to some extent, the human and managerial factors become of significant importance. However, such an aspect of cybersecurity governance that helps to protect against ransomware attacks is mostly overlooked by the research community.  
The factors concerning the proliferation of ransomware attacks are discussed in several studies. The study conducted by [29] investigated several pre-existing constraints that lead to an increasing number of successful ransomware attacks. Among these factors is the difficulty of identifying bottlenecks in the system proactively. The diversity of components and stakeholders at all levels of the system is another factor as the awareness and preparedness vary and one weak component could have a cascading effect on the other components. According to this study, organizational and personality differences influence the efficacy of the policies and countermeasures pertaining to ransomware attack prevention. Qualitative semi-structured interviews with focused groups have been conducted by [30] to investigate ransomware attack strategies against different business environments. Several aspects have been explored including attack vectors, targeted victims, and the nature of the industry. The study shows that ransomware attacks target individual users and machines. It also shows that emails and brute-forcing are the commonly used infection vectors employed by the attackers to deliver the payload to the target.