The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions

Abstract

The proliferation of ransomware has become a significant threat to cybersecurity in recent years, causing significant financial, reputational, and operational damage to individuals and organizations. This paper aims to provide a comprehensive overview of the evolution of ransomware, its taxonomy, and its state-of-the-art research contributions. We begin by tracing the origins of ransomware and its evolution over time, highlighting the key milestones and major trends. Next, we propose a taxonomy of ransomware that categorizes different types of ransomware based on their characteristics and behavior. Subsequently, we review the existing research over several years in regard to detection, prevention, mitigation, and prediction techniques. Our extensive analysis, based on more than 150 references, has revealed that significant research, specifically 72.8%, has focused on detecting ransomware. However, a lack of emphasis has been placed on predicting ransomware. Additionally, of the studies focused on ransomware detection, a significant portion, 70%, have utilized machine learning methods. We further discuss the challenges found such as the ones related to obtaining ransomware datasets. In addition, our study uncovers a range of shortcomings in research pertaining to real-time protection and identifying zero-day ransomware. Adversarial machine learning exploitation has been identified as an under-researched area in the field. This survey is a constructive roadmap for researchers interested in ransomware research matters.

Big Image Data 15Vs Model for Intelligent Data Ocean of Multimedia Things

“…Computers and internet bots are digital tools that can be used for both useful cyber services and bad cyberattacks [72]. Malware bots and internet bots can be programmed or hacked to infiltrate user accounts, systematically search the internet for contact information, send spam, restrict access, or carry out other malicious activities, both locally and globally.…”

MIRAD: A Method for Interpretable Ransomware Attack Detection

“…Instead, a plethora of methods have been developed to explain a part or the entirety of the decision-making process. While many of these methods find use in the broader field of cybersecurity ( [2]), the few that have been used to improve ransomware detection focus mainly on the Android operating system and static detection methods ( [2,3]).…”

“…The increasing number of ransomware attacks in recent years has led to a corresponding rise in research dedicated to ransomware detection. The methods can be broadly divided into static, which attempt to recognize ransomware without letting it execute, and dynamic, which focus on monitoring the consequences of executing ransomware [2][3][4]. Both approaches increasingly rely on machine learning, and both work well as complementary methods [6].…”

Dynamic Behavioural Analysis of Privacy-Breaching and Data Theft Ransomware

“…The academic and professional cybersecurity communities have conducted extensive research on ransomware, developing a deep understanding of its mechanisms, impacts, and countermeasures. Studies have predominantly focused on cryptoransomware, exploring its encryption methods, propagation techniques, and the economic models behind ransom demands [1], [3], [8]- [11]. Despite these efforts, there is a notable lack of focused research on the dynamic behaviors of ransomware that breaches privacy by stealing data.…”