## 3 Ransomware Dynamic Analysis Studies Utilizing both Machine Learning and Deep Learning
### Ransomware Counteraction
#### 6.2.3 Detection
A deep learning method was proposed in [108] to detect the ransomware attacks in edge computing devices. This method enabled the working of edge computing devices by protecting them from the ransomware attacks. Autoencoder of deep learning was used to train and classify the samples in benign and ransomware. The Autoencoder was trained on the behavioral features extracted by analyzing the samples in cuckoo sandbox. An adaptive and scalable ransomware detection framework was proposed in [16] which was able to detect the evolving variants of ransomware. This was an anti-obfuscation framework utilizing the deep learning to perform detection. This framework combined the unsupervised and semi-supervised model. However, this model did not mention its working in context of pre or post encryption phase. A study in [109] was proposed to detect the ransomware attack on SCADA systems. Three deep learning algorithms CNN, DNN, and LSTM were utilized to detect the ransomware attacks. The system worked on stored and real-time data by implementing two phases, i.e., online, and offline phases respectively. Frequency analysis of assembly instructions was used for the features extraction and selection. This framework also provided the backup facility once a system was under attack. DeepGuard a ransomware detection system was proposed in [110] which detected the ransomware from user activity behavior. The file interaction patters of user activity were used to define a profile. Behavior that deviated from the designed model was detected as ransomware. Three sigma limits were applied to generate the legitimated user behavior model along with use of deep generative autoencoders. The model was trained by using the dataset of legitimated user activities. A Dynamic Ransomware Detector based on the improved TextCNN (DRDT) was proposed in [113], which detected the ransomware by utilizing TextCNN. The performance of TextCNN was improved by adding NLP and improving the pooling layer. Processes were monitored to record their behavior and registry modifications. Conventional Detection Studies Utilizing Both Machine Learning and Deep Learning  
There are some conventional studies which implemented both machine learning and deep learning technologies for the ransomware detection purpose. Ransomware detection study named RanSD technique was presented in [80]. This study performed feature engineering by utilizing the static and dynamic analysis along with utilization of machine and deep learning techniques. Mutual information was applied to find the distinct features. However, this study faced decrease in accuracy due to the presence of redundant features. A file and behavioral based detection method was introduced in [91] for backup systems, i.e., cloud services. This system was able to detect the ransomware using entropy technique. Six different file formats were considered, and entropy of these file types were compared with normal and encrypted files entropies. This system was able to detect and recover the files due to compromised. This detection system utilized machine learning classifiers LR, KNN, RF, SVC, SVM, gradient boosting tree and deep learning classifier MLP to detect ransomware attack and recover the loss files. A high survivable ransomware detection study was performed in [104], which utilized SVM and MLP algorithms to perform classification of ransomware. The proposed framework performed detection in three phases. The features were selected by using term frequency inverse document frequency. The performance comparison was performed with respect to other anti-viruses and classifiers. In early detection or pre-encryption detection systems, the attack is detected before the encryption process starts. Here detection is invoked using the subset of runtime data. The early detection system also acts as a prevention technique to stop the encryption in first place [125,128]. Following are the studies that employed the pre-encryption detection concept.