Open Access
A Survey on Ransomware Detection and Prevention Using Machine Learning Models
4
Assistant Professor, Computer Engineering, Sankalchand Patel College of Engineering, Sankalchand Patel University, Visnagar, India
Abstract
Ransomware is one of the most serious cyber-security threats to both individuals and organizations, causing fairly serious financial losses and operational disruption. Ransomware attacks are getting increasingly sophisticated, making it more difficult for traditional signature-based security mechanisms to work effectively, which is why intelligent detection and prevention are needed. The predominant approach used for the detection of ransomware is via pattern recognition and behavior analysis, which is the domain of machine learning. This work provides an in-depth analysis of ransomware, its variants, attack cycles, and the idea of ransomware-as-a-service (RaaS). Furthermore, it discusses both traditional and deep learning approaches to ransomware detection, such as Decision Tree (DT), Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Logistic Regression (LR), Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM) networks. Further, traditional and AI-based ransomware prevention methods, recovery procedures, and a comparative review of recent papers are discussed to identify the existing challenges and potential research directions in ransomware detection and prevention using machine learning.
Keywords
Ransomware,
Cybersecurity,
Machine Learning
References
V. Rohilla, K. Rohilla, P. Kumar, and N. Jain, “Intrusion Detection in Network Traffic Using Feature Selection and Optuna-Based Machine Learning Optimization,” in 2026 3rd International Conference on Research Methodologies in Knowledge Management, Artificial Intelligence and Telecommunication Engineering (RMKMATE), Chennai, India: IEEE, Apr. 2026, pp. 1–6. doi: 10.1109/RMKMATE69073.2026.11518834.
Monika, P. Zavarsky, and D. Lindskog, “Experimental Analysis of Ransomware on Windows and Android Platforms: Evolution and Characterization,” Procedia Comput. Sci., vol. 94, pp. 465–472, 2016, doi: 10.1016/j.procs.2016.08.072.
U. Urooj, B. A. S. Al-rimy, A. Zainal, F. A. Ghaleb, and M. A. Rassam, “Ransomware Detection Using the Dynamic Analysis and Machine Learning: A Survey and Research Directions,” Appl. Sci., vol. 12, no. 1, 2022, doi: 10.3390/app12010172.
J. A. Abraham and S. M. George, “A Survey on Preventing Crypto Ransomware Using Machine Learning,” in 2019 2nd International Conference on Intelligent Computing, Instrumentation and Control Technologies (ICICICT), IEEE, Jul. 2019, pp. 259–263. doi: 10.1109/ICICICT46008.2019.8993137.
V. Pahuja, A. Khanna, and I. Sharma, “RansomSheild: Novel Framework for Effective Data Recovery in Ransomware Recovery Process,” in 2024 IEEE International Conference on Big Data & Machine Learning (ICBDML), IEEE, Feb. 2024, pp. 240–245. doi: 10.1109/ICBDML60909.2024.10577365.
M. Aljabri et al., “Ransomware detection based on machine learning using memory features,” Egypt. Informatics J., vol. 25, p. 100445, Mar. 2024, doi: 10.1016/j.eij.2024.100445.
R. E. Asma A.Alhashmi, Abdulbasit A. Darem, Ahmed B. Alshammari, Laith A. Darem, Huda K. Sheatah, “Ransomware Early Detection Techniques,” Eng. Technol. Appl. Sci., vol. 14, no. 3, pp. 14497–14503, 2024.
M. Cen, F. Jiang, X. Qin, Q. Jiang, and R. Doss, “Ransomware early detection: A survey,” Comput. Networks, vol. 239, p. 110138, Feb. 2024, doi: 10.1016/j.comnet.2023.110138.
R. T. Da-Yu KAO , Shou-Ching HSIO, “Analyzing WannaCry Ransomware Considering the Weapons and Exploits,” ICACT Trans. Adv. Commun. Technol., vol. 7, no. 2, pp. 1098–1108, 2018.
A. Zimba, L. Simukonda, and M. Chishimba, “Demystifying Ransomware Attacks: Reverse Engineering and Dynamic Malware Analysis of WannaCry for Network and Information Security,” Zambia ICT J., vol. 1, no. 1, pp. 35–40, Dec. 2017, doi: 10.33260/zictjournal.v1i1.19.
M. S. Hosain, “Ransomware: Are We Safe on the Web?,” Inf. Secur. Technol., vol. 1, no. 103, pp. 1–9, 2022.
S. C. Pallaprolu, “Zero-day Attack Identification in Streaming Data: Nearest Neighbor Heuristics and Dynamic Semantic Network Generation in the Spark Eco-system,” University of Maryland, Baltimore County, 2017.
G. Nagar, “The evolution of ransomware: tactics, techniques, and mitigation strategies,” Int. J. Sci. Res. Manag., vol. 12, pp. 1282--1298, 2024.
S. P.Sivashanmugam, S. Kumara, A. Mohile, and D. R. Suram, “Improving Detection Accuracy of Phishing Attacks with Feature Selection and Machine learning Techniques in Cybersecurity,” in 2026 1st International Conference on Emerging Trends in Advancements and Applications of Computational Intelligence Techniques (ETAACT), Bhubaneswar, India: IEEE, Apr. 2026, pp. 1–6. doi: 10.1109/ETAACT69135.2026.11542138.
M. Najafabadi, F. Villanustre, T. Khoshgoftaar, N. Seliya, R. Wald, and E. Muharemagic, “Deep learning applications and challenges in big data analytics,” J. Big Data, vol. 2, 2015, doi: 10.1186/s40537-014-0007-7.
S. Debnath, S. A. Devanira Poovaiah, N. Khurramov, S. A. Chikop, and S. Sadullaeva, “KEDenNet-MEO: A Knowledge-Driven Deep Intrusion Detection Framework for VANETs with Realistic Mobility Simulation,” in 2025 International Conference on Innovations in Intelligent Systems: Advancements in Computing, Communication, and Cybersecurity (ISAC3), IEEE, Jul. 2025, pp. 1–6. doi: 10.1109/ISAC364032.2025.11156856.
J. Ferdous, R. Islam, A. Mahboubi, and M. Zahidul Islam, “AI-Based Ransomware Detection: A Comprehensive Review,” IEEE Access, vol. 12, pp. 136666–136695, 2024, doi: 10.1109/ACCESS.2024.3461965.
R. Soni, A. Kumar, A. Vashisth, and G. Kaur, “Next-Generation AI-Driven Ransomware Detection: Trends, Taxonomy, and Their Limitations,” in 2026 3rd International Conference on Emerging Trends in Engineering and Medical Sciences (ICETEMS), 2026, pp. 1–6. doi: 10.1109/ICETEMS66917.2026.11469261.
A. Azmoodeh, A. Dehghantanha, M. Conti, and K.-K. R. Choo, “Detecting crypto-ransomware in IoT networks based on energy consumption footprint,” J. Ambient Intell. Humaniz. Comput., vol. 9, no. 4, pp. 1141–1152, 2018, doi: 10.1007/s12652-017-0558-5.
M. Mittal, “Quantum Machine Learning: Harnessing Quantum Algorithms for Supervised and Unsupervised Learning,” Int. J. Innov. Res. Sci. Eng. Technol., vol. 11, no. 09, Sep. 2022, doi: 10.15680/IJIRSET.2022.1109004.
A. Alraizza and A. Algarni, “Ransomware Detection Using Machine Learning: A Survey,” Big Data Cogn. Comput., vol. 7, no. 3, p. 143, Aug. 2023, doi: 10.3390/bdcc7030143.
M. S. Akhtar and T. Feng, “Detection of Malware by Deep Learning as CNN-LSTM Machine Learning Techniques in Real Time,” Symmetry (Basel)., vol. 14, no. 11, 2022, doi: 10.3390/sym14112308.
S. Kakkar, S. Janarthanan, B. Makkena, and A. Kakkar, “Deep Learning Approaches for Predicting Attack Vulnerabilities in Quantum-Secure Financial Networks,” in 2026 International Conference on Emerging Systems and Intelligent Computing (ESIC), IEEE, Feb. 2026, pp. 780–785. doi: 10.1109/ESIC68176.2026.11496277.
M. Davidian, M. Kiperberg, and N. Vanetik, “Early Ransomware Detection with Deep Learning Models,” Futur. Internet, vol. 16, no. 8, 2024, doi: 10.3390/fi16080291.
T. Jabid et al., “Pre-Print Ransomware Prevention Strategies: Building Robust Cyber Defenses,” 2025.
K. S. Anjani Gupta, “Malware Analysis on AI Technique,” 2022.
M. Jabid, Taskeed and Rashid, Mohammad Rifat Ahmmad and Ferdaus, Md Hasanul and Ali, Md Sawkat and Islam, Mohammad Manzurul and Hasan, Mahamudul and Islam, “Ransomware prevention strategies: Building robust cyber defenses,” Ransomware Evol., pp. 141–171, 2024.
K. J. Hole, “Robustness to Malware Reinfections,” in Anti-fragile ICT Systems, Cham: Springer International Publishing, 2016, pp. 93–98. doi: 10.1007/978-3-319-30070-2_9.
D. P. Marius-Constantin Ilau, Adriam Baldwin, Tristan Caulfield, “Modelling and simulating organizational ransomware recovery: structure, methodology, and decisions,” J. Cybersecurity, vol. 11, no. 1, p. 45, 2025.
D. Manivannan, “A Comprehensive and Critical Analysis of Ransomware Detection, Prevention, Mitigation, and Recovery Approaches,” J. Cybersecurity, vol. 8, p. 397, 2026.
R. Kakadiya, K. Vora, A. Bambharoliya, and H. Kag, “AI-Driven Cyber Defense for Malware and Ransomware Protection,” in 2026 18th International Conference on Electronics, Computers and Artificial Intelligence (ECAI), IEEE, Jul. 2026, pp. 1–7. doi: 10.1109/ECAI69016.2026.11613710.
V. S. Vivek, V. Lokesh, T. Kaushik, U. Kumaran, B. Umah, and G. G. Devarajan, “Ransome Ware Detection Using Machine Learning and Deep Learning Models,” in Proceedings of International Conference on Recent Trends in Computing, R. P. Mahapatra, S. Roy, and P. Parwekar, Eds., Singapore: Springer Nature Singapore, 2025, pp. 105–117.
M. Rele, J. Samuel, D. Patil, and U. Krishnan, “Exploring Ransomware Detection Based on Artificial Intelligence and Machine Learning,” Procedia Comput. Sci., vol. 252, pp. 548–556, 2025, doi: 10.1016/j.procs.2025.01.014.
W. F. Elsersy, A. ElShamy, and M. Samy, “Ransomware Detection Using Machine Learning Algorithms,” in 2024 Intelligent Methods, Systems, and Applications (IMSA), IEEE, Jul. 2024, pp. 186–192. doi: 10.1109/IMSA61967.2024.10652659.
Most read articles by the same author(s)
- Dr. Mateo Alvarez-Ruiz, From Reactive to Predictive Security: Integrating Threat Intelligence with SIEM for Proactive Threat Hunting , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 01 (2026): Volume 03 Issue 01
- John M. Callahan, Advancing Cyber Threat Intelligence Frameworks: Integrative Models, Sharing Mechanisms, and Predictive Analytics , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 07 (2025): Volume 02 Issue 07
- Prof. Dmitry V. Volkov, Dr. Kofi Agyapong, ADAPTIVE TRUST BOUNDARY ENFORCEMENT: A COMPREHENSIVE REVIEW OF ZERO TRUST ARCHITECTURE IMPLEMENTATION AND USABILITY CHALLENGES , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 10 (2025): Volume 02 Issue 10
- Dr. Claire Whitman, LEVERAGING CYBER THREAT INTELLIGENCE MINING FOR ENHANCED PROACTIVE CYBERSECURITY: A COMPREHENSIVE REVIEW AND FUTURE DIRECTIONS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 1 No. 01 (2024): Volume 01 Issue 01
- Dr. Thomas Becker, Kevin Brooks, STRENGTHENING CYBER RESILIENCE: A COMPREHENSIVE EVALUATION OF SOCIAL ENGINEERING AWARENESS PROGRAMS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 1 No. 01 (2024): Volume 01 Issue 01
- Dr. Laura Stein, ADVANCING PROACTIVE CYBERSECURITY THROUGH CYBER THREAT INTELLIGENCE MINING: A COMPREHENSIVE REVIEW AND FUTURE DIRECTIONS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 02 (2025): Volume 02 Issue 02
- Dr. Rohan Deshmukh, ARCHITECTING A ROBUST CYBER THREAT INTELLIGENCE CAPABILITY: A COMPREHENSIVE FRAMEWORK , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 02 (2025): Volume 02 Issue 02
- Dr. Alistair Finch, Navigating the Digital Battlefield: A Systematic Review of Collateral Effects in Offensive Cyber Operations , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 08 (2025): Volume 02 Issue 08
- Dr. Layla Hassan, Reem Al-Mazrouei, EVOLVING PARADIGMS AND FUTURE TRAJECTORIES IN CYBER THREAT INTELLIGENCE , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 06 (2025): Volume 02 Issue 06
- Dr. Arben Kola, Dr. Elira Hoxha, Dr. Gentian Leka, Study of Threat Evaluation and Forecasting Framework for Communication Infrastructure Using Neural Intelligence Techniques , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
Similar Articles
- Julia H. Whitaker, PROACTIVE CYBER THREAT HUNTING AND PREDICTIVE INTELLIGENCE IN CLOUD-ENABLED CRITICAL INFRASTRUCTURE: AN INTEGRATED FRAMEWORK FOR RESILIENT DIGITAL ECOSYSTEMS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 02 (2026): Volume 03 Issue 02
- Dr. Dmitry V. Sokolov, Synergizing Generative AI and Explainable Machine Learning in Security Operations Centers: Mitigating Alert Fatigue and Enhancing Analyst Performance , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 10 (2025): Volume 02 Issue 10
- Dr. Nyra Quellin, Strategic Risk-Based Cybersecurity Governance: Integrating Policy Frameworks, Organizational Controls, and Compliance Mechanisms for Contemporary Information Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 01 (2026): Volume 03 Issue 01
- Mr. Deepak Mehta, A Review of Explainable Machine Learning Methods for Malware Detection and Classification , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 07 (2026): Volume 03 Issue 07
- Mr. Madhav Sharma, Cybersecurity Threat Intelligence Using Machine Learning Classification Techniques , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Arben Kola, Dr. Elira Hoxha, Dr. Gentian Leka, Study of Threat Evaluation and Forecasting Framework for Communication Infrastructure Using Neural Intelligence Techniques , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Dr.Jvalant Kumar Kanaiyalal Patel, Survey of Artificial Intelligence-Driven Zero-Day Vulnerability Detection Techniques in Cloud Computing Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 07 (2026): Volume 03 Issue 07
- Dr. Laura Stein, ADVANCING PROACTIVE CYBERSECURITY THROUGH CYBER THREAT INTELLIGENCE MINING: A COMPREHENSIVE REVIEW AND FUTURE DIRECTIONS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 02 (2025): Volume 02 Issue 02
- Dr. Chinedu Okafor, Dr. Aisha Bello, An Intelligent Risk-Aware Security Framework for Detection and Prevention of Cyber Attacks on Critical Power Grid Infrastructure in Nigeria’s Electricity Sector , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Mariam Al-Falasi, Dr. Tao Zhang, AUGMENTING SIEM WITH THREAT INTELLIGENCE FOR PREDICTIVE CYBER DEFENSE: A PROACTIVE THREAT HUNTING APPROACH , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 03 (2025): Volume 02 Issue 03
1-10 of 47
Next
You may also start an advanced similarity search for this article.