## 4 Ransomware Detection Studies w.r.t Compromised Platforms
### Ransomware Attacks on PC and Smartphones  
Number of personal computers and its usage is growing every day exponentially. The outdated computers and anti-viruses make the launch of ransomware attack easier. Different operating systems of desktop computers are being targeted [92]. Mobile ransomwares, \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**Ransomware Detection Studies w.r.t. Victim Platform**} \\ \hline \multirow{2}{*}{**Sr\#**} & \multirow{2}{*}{**Study**} & \multicolumn{2}{c}{**Desktop and Smartphone**} & \multicolumn{2}{c}{**IoT Ecosystem**} & \multirow{2}{*}{**Networks**} \\ \cline{2-2} \cline{5-7}  & & **PC** & **Smartphone** & **Cloud** & **Fog** & **IoT** & \\ \hline  
\hline \end{tabular}
\end{table} 
Table 2: Ransomware detection studies w.r.t. compromised platform. attack the mobile platforms. These ransomwares attacks are launched when the mobile user download and install a trojan or a fake app. Fake apps spread via untrusted third-party app stores. Mobile screen gets locked, and all the mobile data gets encrypted including contact lists and the user is asked to pay the ransom. Victims are threatened with the loss of their mobile data, sharing of personal information, and browsing history to their contact lists. Android.Lockdroid.E is one of the example of mobile ransomware [57,86]. A desktop ransomware detection approach was proposed in [50]. This system, named Self Defensible SSD, utilized the storage to detect the ransomware. This system was also able to provide backup by using the garbage collector which hold the original data. This system performed detection and backup without the use of decryption key. A windows based ransomware detection system was developed in [83]. This model was able to detect the ransomware in the early stages. The system built a normal profile by using the unstructured data of the log files from an institution. This system performed detection and prevention of ransomware attacks by using the machine learning algorithm. UNVEIL [14], a detection system was proposed for the windows platform. This system performed ransomware detection by using the desktop screenshots and calculating the similarity score for them. System focused on the desktop screen to detect the unknown ransomwares. This system operated in the kernel and worked with file system drivers. In [72], an android mobile based detection approach HELDROID was presented. This approach also detected the zero-day ransomware. However, this approach is limited due to dependency on the training language of detection model. It required 30 min to train the model for new language. R-PackDroid [57], an android based ransomware detection system was presented which labeled the program into ransomware, malware, or trusted application. A supervised ML classifier was used to classify the subjected program into benign and ransomware. However, this system was not able to perform the detection during execution. A technique based on formal methods for the detection of mobile ransomware in the smartphone devices was proposed in [8]. The apps running as android ransomwares were detected and removed from the device. It inspected the malicious behavior at bytecode level by employing the full static approach. This technique lacked in disassembling all selected samples which was limitations of this work. To solve the disassembling problem lower number of morphed samples were utilized. Samples used were taken from top 10 most popular families. A ransomware prevention technique was developed in [55]. This technique performed detection by collecting data from the processors, I/O, and storage devices. The android processes and directories were monitored to perform the detection. This technique was implemented at kernel level hence imposed less overhead. User was able to decide the processing or termination of a suspicious process. A two stage ransomware detection model for windows platform was developed in [88]. First stage is developed using Markov and the second stage by using RF.