## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.2 Prevention  
Proactive Prevention  
In [55], a preventive technique was proposed for the android platform. It continuously monitored the processes and directories for ransomware detection. It utilized the statistical data collected from processor, memory, storage, and I/O devices to detect, and remove the ransomware. Process with abnormal behavior carried different statistics was stopped and terminated. This technique was faster as it implemented at kernel level in android source code. This technique was also able to detect ransomware with new patterns. User feedback was involved to decide the continuation of detected processes. Device performance was degraded after the use of proposed technique. A ransomware detection model was presented in [66] which extracted payloads from real world network traffic. It was a preventive and detection model which could inspect the beginning of an attack. This detection technique utilized deep and machine learning to inspect the network traffic. Model executed in the static state and was trained on raw payloads and http requests. An early ransomware detection and prevention model was developed in [83]. The prevention system perform functionality in 4 phases on unstructured data of Petya and Wannacy. Ransomware attack patterns and relevant features of ransomware attack were collected. Detection was performed by utilizing the machine learning algorithms. In [93], a high survivable ransomware detection and prevention approach was presented. This approach prevent data from encryption by aborting the encrypting process. This approach stopped the encryption before it takes place. HSR used domain generation algorithm. This approach consisted of two modules, i.e., connection monitor and connection break. A process with no valid connection was mentioned suspicious. Once a connection was mentioned suspicious, all other users broke connection with it. This approach was based on stopping the key exchange to prevent the attack. A proactive ransomware prevention model was proposed in [120]. This model also detected the ransomware attack by performing the hybrid analysis on black/whitelist and user list samples. This model utilized the social engineering to assess the occurrenceof a ransomware attack. The hybrid analysis and frequency analysis were performed to calculate the injury and conditional frequency analysis. I. Reactive Prevention  
A ransomware detection approach was proposed in [50] which also provided the data backup. This system was able to hold original data by using the garbage collector. This system performed detection by using the frequent read and rewrite requests on the storage devices. This system utilized the storage devices and its data, which is why it is called Self Defensible SSD. A ransomware detection tool named RAPPER was presented in [81]. This tool performed ransomware detection in two steps. Running processes were observed by calculating the statistics from hardware performance counter (HPC). In the second step, analysis and detection was done. LSTM and Fast Fourier transformation were utilized to generate fast, reliable, and accurate result. This framework provided the backup if ransomware attack occurs. A ransomware detection framework was proposed in [109] for Supervisory Control and Data Acquisition system (SCADA). The proposed framework assessed the impact of ransomware attack on SCADA. This framework worked in two phases to perform detection. This deep learning-based model worked on online and offline data. This system issued an automatic driven supervisory command to other stations if a ransomware attack occurs. This system also restored the data to cope with attack. A ransomware detection system was proposed for the backup systems in [91]. This system was able to recover the data when the system was infected by the ransomware attack. Detection of a ransomware attack was performed by calculating the entropy of six different file formats.