# Artificial Intelligence in Cybersecurity: A Review and a Case Study
## 4 Ransomware: A Growing Threat in the Cybersecurity Landscape  
Ransomware is a type of malicious software that encrypts user files, rendering them inaccessible. Its purpose is to extort a payment from the victim in exchange for unlocking the files. A major ransomware attack called WannaCry struck the world in 2017. This event significantly heightened public awareness of cybersecurity threats. In recent years, the proliferation of ransomware has become a major concern, inflicting substantial financial losses, reputational damage, and operational disruptions on individuals and organizations alike. In Table 1, well-known ransomware is listed [16]. Ransomware emerged in 1989 and has rapidly evolved into a sophisticated and widespread threat. Its encryption techniques have become increasingly complex, its ability to spread and evade detection has grown, and its capacity to extort victims has intensified. The global damage caused by ransomware attacks is on a trajectory to surpass hundreds of billions of US dollars in the coming years, with new attacks occurring within seconds. The cumulative worldwide damage from ransomware incidents has been steadily rising over time [17; 18]. While human analysts struggle to keep pace with the ever-growing volume of data, AI excels in this domain. Its ability to analyze massive datasets makes them highly effective for ransomware detection. In this context, AI algorithms are trained on a colossal collection of both benign and malicious software. By analyzing the behavior of these programs, the algorithms learn to identify the characteristic traits that distinguish ransomware from legitimate applications. This acquired knowledge empowers them to detect even novel ransomware variants, even those never encountered before [16; 19]. The authors of paper [18] provide an exploration of ransomware, delving into its history, classification (taxonomy), and the research efforts aimed at mitigating the threat. They trace ransomware's origins and major trends that have shaped its evolution. They propose a taxonomy to categorize different ransomware types based on their unique characteristics and behaviors. The study goes on to identify shortcomings in current research, particularly regarding real-time protection and zero-day ransomware identification. While this study has contributed to the field, significant challenges persist, necessitating continued research efforts in ransomware mitigation and prevention. While traditional supervised learning methods are widely used for malware detection, their limitations hinder their effectiveness. Their main limitations are difficulties in achieving high accuracy and difficulties in handling complex malware strains. Because of these limitations, it is necessary to explore alternative approaches for more effective detection.At this point, DL techniques can be useful. Its detection accuracy and reliable outputs can offer a good solution. Algorithms using these techniques offer several advantages. These advantages include using automatic feature generation, as well as eliminating the need for manual feature engineering. They can learn from datasets given to them, and this process can be automated to minimize human interaction. This minimization ultimately enables rapid real-time detection. However, there are some challenges when using DL approaches. The main challenge is the need of large amounts of data. This data is used for training these algorithms. These algorithms are not suitable if limited datasets are used for a malware application. Another problem with these algorithms occurs when they are used on systems with low processing power. This can be a problem for resource constraint systems. Finally, adapting these techniques to real-world datasets can be problematic, as real-world data often deviate from the training data used in the development process. Despite these challenges, DL offers a powerful tool in the fight against ransomware.