## 6 Research in Ransomware Detection
### Ransomware Analysis
#### 6.1.2 Dynamic Analysis  
Dynamic analysis is an active approach performed by executing the malicious code. Malicious code run under controlled environment and exhibited features are captured by the controlled environment [24; 27]. Figure 5: Ransomware analysis overview. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline  & & \multicolumn{4}{c}{**Ransomware Analysis**} \\ \hline \multirow{2}{*}{**Sr\#**} & \multirow{2}{*}{**Study**} & \multicolumn{4}{c}{**Dynamic**} & \multicolumn{2}{c}{**Hybrid**} \\ \cline{3-8}  & & **ML** & **DL** & **ML and DL** & **ML** & **DL** & **ML and DL** \\ \hline
1 & [94] & ✓ & & & & \\ \hline
2 & [20] & ✓ & & & & \\ \hline
3 & [89] & & ✓ & & & \\ \hline
4 & [62] & & ✓ & & & \\ \hline
5 & [80] & & & & & ✓ \\ \hline
6 & [85] & & ✓ & & & \\ \hline
7 & [90] & & ✓ & & & \\ \hline
8 & [81] & & ✓ & & & \\ \hline
9 & [119] & ✓ & & & & \\ \hline
10 &
\begin{tabular}{c} RANDS \\ [96] \\ \end{tabular} & ✓ & & & & & \\ \hline
11 & [97] & & ✓ & & & \\ \hline
12 & [7] & ✓ & & & \\ \hline
13 & [98] & ✓ & & & \\ \hline
14 &
\begin{tabular}{c} PEDA \\ [79] \\ \end{tabular} & & & & ✓ & \\ \hline
15 & [99] & ✓ & & & \\ \hline
16 &
\begin{tabular}{c} RanStop \\ [100] \\ \end{tabular} & & ✓ & & & \\ \hline
17 & [101] & ✓ & & & \\ \hline
18 & [91] & & ✓ & & \\ \hline
19 & [95] & ✓ & & & \\ \hline
20 & [102] & ✓ & & & \\ \hline
21 & [118] & ✓ & & & \\ \hline
22 &
\begin{tabular}{c} AIRaD \\ [103] \\ \end{tabular} & & & & ✓ & \\ \hline
23 & [104] & & ✓ & & \\ \hline
24 & [105] & & & ✓ & \\ \hline
25 & [106] & & & ✓ & \\ \hline
26 & [88] & ✓ & & & \\ \hline
27 & [107] & & & & \\ \hline
28 & [108] & & ✓ & & \\ \hline
29 & [16] & & ✓ & & \\ \hline
30 & [109] & & ✓ & & \\ \hline
31 &
\begin{tabular}{c} DeepGuard \\ [110] \\ \end{tabular} & & ✓ & & \\ \hline
32 & [112] & ✓ & & & \\ \hline
33 &
\begin{tabular}{c} DRDT \\ [113] \\ \end{tabular} & & ✓ & & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Studies performed dynamic and hybrid analysis for ransomware detection. A system named EldeRan was presented in [58]. This system performed dynamic analysis to monitor the operations performed by the applications. API calls and strings were captured during runtime to observe the dynamic behavior of ransomware applications. Applications were monitored during their installation process to capture the ransomware discriminating features. This study was based on a concept that a ransomware sample exhibits its unique behavior in the actions performed in early phases of its installation. A ransomware detection system consisting of 4 layer of deep belief network was proposed in [48]. This was an online detection solution for the embedded systems and IoT devices. System performed behavioral analysis. This detection solution utilized the optimized approach. Features were extracted from http requests and cryptographic system calls from the installation process of an application. An automated ransomware detecting approach utilizing the LSTM, a deep learning technique was presented in [63]. To observe the behavior of a process, API calls were considered as point of focus. Cuckoo extracted the API calls using the API hooks. The study utilized the dynamic analysis to get the API calls sequence. However, this study run the analysis for 20 min which was the limitation of this study. A detection system was proposed in [60] by combining sequential pattern mining for the feature identification with machine learning classification techniques. A dataset of 1624 ransomware samples were used to perform analysis. Bagging, J48, and RF were used as machine learning technique while multilayer perceptron was used as deep learning techniques. However, the samples were executed for only 10 s which can be easily evade by obfuscated ransomware samples. A greedy stepwise search method was used to find the distinctive features which identified the ransomware samples. In [64], the proposed system applied the machine learning and deep learning technique multi-layer perceptron (MLP) for the ransomware detection and classification.