## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.3 Detection
However, study did not explain more details about the analysis and other aspects. A system DNAact-Ran was proposed in [127] which utilized revolutionary digital DNA sequencing along with machine learning to detect the ransomware. This system was able to predict the ransomware due to the use of DNA sequencing. From a provided dataset, features were selected by using MOGWO and BCS and Digital DNA designed by  
Figure 6: Overview of detection studies. using k-mer frequency and DNA sequencing. The proposed system utilized NB, RF and SMO to classify the detected ransomware family. An AI based ransomware detection framework AIRaD along with machine learning algorithms was proposed in [103]. Machine learning algorithms included in the work were SVM, LR, RF, and Adaboost with J48 and J48. Both behavioral and reverse engineering were used to detect the ransomware at multi-level. A signature repository was produced by using PIN tool, Cuckoo, and reverse engineering. A multi-tier ransomware detection model was proposed in [105] which was able to detect the zero-day ransomware attacks. This hybrid detection model used static and dynamic traits to detect the ransomware from realistic and non-realistic environment. For realistic environment data was gathered for one month. This detection model classified the sample files into malware, ransomware, and benign. The infected events were observed both statistically and dynamically. Two machine learning algorithms DT and NB were used to classify the attack. A machine learning based ransomware detection model was built in [88]. This model performed detection in two stages. Detection was performed by Markov model which was built by using the windows API calls. In the first stage dynamic analysis was performed in cuckoo along with the use of Markov model. In second stage machine learning algorithm random forest was used to perform detection  
* Conventional Detection Studies Utilizing Deep Learning  
Different conventional detection studies in the literature utilized the deep learning approach to detect the ransomware. Some of them are discussed below. A detection and prevention tool named RAPPER was presented in [81] for the cryptotransomware attacks. This study utilized the LSTM and Fast Fourier transformation to develop the detection system. Hardware performance counter was focused to detect the behavior of a malicious process, i.e., ransomware. The LSTM based autoencoders detected the unusual behavior of the process. The system activities were observed for 10 ms intervals which was the limitation of this system. After 10 ms the captured data was transformed into frequency domain by using the fast Fourier transformation. System provided backup if files encrypted from ransomware attack observed. A fog layer ransomware detection system named DRTHIS was presented in [62]. System focused on the system call sequences to trace the ransomware attacks in 10 s. This detection system utilized two deep learning technologies, convolutional neural network, and long short-term memory for sample classification into ransomware or benign. This system was able to detect the zero-day ransomware families. A ransomware detection study utilizing deep learning techniques was proposed in [89]. This detection model was proposed for the industrial IoT while dealing with unbalanced and high dimensional data. Two deep learning autoencoders were used to extract the features. One encoder performed unsupervised learning while other performed controlling operation. Both worked together to perform hybrid feature engineering. Data extracted after hybrid feature engineering was used to train the deep neural network. A stacked variational autoencoder architecture was used to detect the ransomware using a blend of supervised and unsupervised learning methods [90]. This detection system was proposed to protect the industrial IoT systems. The study also utilized the data augmentation strategy to analyze data to increase the efficiency of the system. However, this study did not elaborate the analysis details.