Open Access
A Survey on Ransomware Detection and Prevention Using Machine Learning Models
4
Assistant Professor, Computer Engineering, Sankalchand Patel College of Engineering, Sankalchand Patel University, Visnagar, India
Abstract
Ransomware is one of the most serious cyber-security threats to both individuals and organizations, causing fairly serious financial losses and operational disruption. Ransomware attacks are getting increasingly sophisticated, making it more difficult for traditional signature-based security mechanisms to work effectively, which is why intelligent detection and prevention are needed. The predominant approach used for the detection of ransomware is via pattern recognition and behavior analysis, which is the domain of machine learning. This work provides an in-depth analysis of ransomware, its variants, attack cycles, and the idea of ransomware-as-a-service (RaaS). Furthermore, it discusses both traditional and deep learning approaches to ransomware detection, such as Decision Tree (DT), Random Forest (RF), Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Logistic Regression (LR), Deep Neural Networks (DNN), Convolutional Neural Networks (CNN), and Long Short-Term Memory (LSTM) networks. Further, traditional and AI-based ransomware prevention methods, recovery procedures, and a comparative review of recent papers are discussed to identify the existing challenges and potential research directions in ransomware detection and prevention using machine learning.
Keywords
Ransomware,
Cybersecurity,
Machine Learning
References
V. Rohilla, K. Rohilla, P. Kumar, and N. Jain, “Intrusion Detection in Network Traffic Using Feature Selection and Optuna-Based Machine Learning Optimization,” in 2026 3rd International Conference on Research Methodologies in Knowledge Management, Artificial Intelligence and Telecommunication Engineering (RMKMATE), Chennai, India: IEEE, Apr. 2026, pp. 1–6. doi: 10.1109/RMKMATE69073.2026.11518834.
Monika, P. Zavarsky, and D. Lindskog, “Experimental Analysis of Ransomware on Windows and Android Platforms: Evolution and Characterization,” Procedia Comput. Sci., vol. 94, pp. 465–472, 2016, doi: 10.1016/j.procs.2016.08.072.
U. Urooj, B. A. S. Al-rimy, A. Zainal, F. A. Ghaleb, and M. A. Rassam, “Ransomware Detection Using the Dynamic Analysis and Machine Learning: A Survey and Research Directions,” Appl. Sci., vol. 12, no. 1, 2022, doi: 10.3390/app12010172.
J. A. Abraham and S. M. George, “A Survey on Preventing Crypto Ransomware Using Machine Learning,” in 2019 2nd International Conference on Intelligent Computing, Instrumentation and Control Technologies (ICICICT), IEEE, Jul. 2019, pp. 259–263. doi: 10.1109/ICICICT46008.2019.8993137.
V. Pahuja, A. Khanna, and I. Sharma, “RansomSheild: Novel Framework for Effective Data Recovery in Ransomware Recovery Process,” in 2024 IEEE International Conference on Big Data & Machine Learning (ICBDML), IEEE, Feb. 2024, pp. 240–245. doi: 10.1109/ICBDML60909.2024.10577365.
M. Aljabri et al., “Ransomware detection based on machine learning using memory features,” Egypt. Informatics J., vol. 25, p. 100445, Mar. 2024, doi: 10.1016/j.eij.2024.100445.
R. E. Asma A.Alhashmi, Abdulbasit A. Darem, Ahmed B. Alshammari, Laith A. Darem, Huda K. Sheatah, “Ransomware Early Detection Techniques,” Eng. Technol. Appl. Sci., vol. 14, no. 3, pp. 14497–14503, 2024.
M. Cen, F. Jiang, X. Qin, Q. Jiang, and R. Doss, “Ransomware early detection: A survey,” Comput. Networks, vol. 239, p. 110138, Feb. 2024, doi: 10.1016/j.comnet.2023.110138.
R. T. Da-Yu KAO , Shou-Ching HSIO, “Analyzing WannaCry Ransomware Considering the Weapons and Exploits,” ICACT Trans. Adv. Commun. Technol., vol. 7, no. 2, pp. 1098–1108, 2018.
A. Zimba, L. Simukonda, and M. Chishimba, “Demystifying Ransomware Attacks: Reverse Engineering and Dynamic Malware Analysis of WannaCry for Network and Information Security,” Zambia ICT J., vol. 1, no. 1, pp. 35–40, Dec. 2017, doi: 10.33260/zictjournal.v1i1.19.
M. S. Hosain, “Ransomware: Are We Safe on the Web?,” Inf. Secur. Technol., vol. 1, no. 103, pp. 1–9, 2022.
S. C. Pallaprolu, “Zero-day Attack Identification in Streaming Data: Nearest Neighbor Heuristics and Dynamic Semantic Network Generation in the Spark Eco-system,” University of Maryland, Baltimore County, 2017.
G. Nagar, “The evolution of ransomware: tactics, techniques, and mitigation strategies,” Int. J. Sci. Res. Manag., vol. 12, pp. 1282--1298, 2024.
S. P.Sivashanmugam, S. Kumara, A. Mohile, and D. R. Suram, “Improving Detection Accuracy of Phishing Attacks with Feature Selection and Machine learning Techniques in Cybersecurity,” in 2026 1st International Conference on Emerging Trends in Advancements and Applications of Computational Intelligence Techniques (ETAACT), Bhubaneswar, India: IEEE, Apr. 2026, pp. 1–6. doi: 10.1109/ETAACT69135.2026.11542138.
M. Najafabadi, F. Villanustre, T. Khoshgoftaar, N. Seliya, R. Wald, and E. Muharemagic, “Deep learning applications and challenges in big data analytics,” J. Big Data, vol. 2, 2015, doi: 10.1186/s40537-014-0007-7.
S. Debnath, S. A. Devanira Poovaiah, N. Khurramov, S. A. Chikop, and S. Sadullaeva, “KEDenNet-MEO: A Knowledge-Driven Deep Intrusion Detection Framework for VANETs with Realistic Mobility Simulation,” in 2025 International Conference on Innovations in Intelligent Systems: Advancements in Computing, Communication, and Cybersecurity (ISAC3), IEEE, Jul. 2025, pp. 1–6. doi: 10.1109/ISAC364032.2025.11156856.
J. Ferdous, R. Islam, A. Mahboubi, and M. Zahidul Islam, “AI-Based Ransomware Detection: A Comprehensive Review,” IEEE Access, vol. 12, pp. 136666–136695, 2024, doi: 10.1109/ACCESS.2024.3461965.
R. Soni, A. Kumar, A. Vashisth, and G. Kaur, “Next-Generation AI-Driven Ransomware Detection: Trends, Taxonomy, and Their Limitations,” in 2026 3rd International Conference on Emerging Trends in Engineering and Medical Sciences (ICETEMS), 2026, pp. 1–6. doi: 10.1109/ICETEMS66917.2026.11469261.
A. Azmoodeh, A. Dehghantanha, M. Conti, and K.-K. R. Choo, “Detecting crypto-ransomware in IoT networks based on energy consumption footprint,” J. Ambient Intell. Humaniz. Comput., vol. 9, no. 4, pp. 1141–1152, 2018, doi: 10.1007/s12652-017-0558-5.
M. Mittal, “Quantum Machine Learning: Harnessing Quantum Algorithms for Supervised and Unsupervised Learning,” Int. J. Innov. Res. Sci. Eng. Technol., vol. 11, no. 09, Sep. 2022, doi: 10.15680/IJIRSET.2022.1109004.
A. Alraizza and A. Algarni, “Ransomware Detection Using Machine Learning: A Survey,” Big Data Cogn. Comput., vol. 7, no. 3, p. 143, Aug. 2023, doi: 10.3390/bdcc7030143.
M. S. Akhtar and T. Feng, “Detection of Malware by Deep Learning as CNN-LSTM Machine Learning Techniques in Real Time,” Symmetry (Basel)., vol. 14, no. 11, 2022, doi: 10.3390/sym14112308.
S. Kakkar, S. Janarthanan, B. Makkena, and A. Kakkar, “Deep Learning Approaches for Predicting Attack Vulnerabilities in Quantum-Secure Financial Networks,” in 2026 International Conference on Emerging Systems and Intelligent Computing (ESIC), IEEE, Feb. 2026, pp. 780–785. doi: 10.1109/ESIC68176.2026.11496277.
M. Davidian, M. Kiperberg, and N. Vanetik, “Early Ransomware Detection with Deep Learning Models,” Futur. Internet, vol. 16, no. 8, 2024, doi: 10.3390/fi16080291.
T. Jabid et al., “Pre-Print Ransomware Prevention Strategies: Building Robust Cyber Defenses,” 2025.
K. S. Anjani Gupta, “Malware Analysis on AI Technique,” 2022.
M. Jabid, Taskeed and Rashid, Mohammad Rifat Ahmmad and Ferdaus, Md Hasanul and Ali, Md Sawkat and Islam, Mohammad Manzurul and Hasan, Mahamudul and Islam, “Ransomware prevention strategies: Building robust cyber defenses,” Ransomware Evol., pp. 141–171, 2024.
K. J. Hole, “Robustness to Malware Reinfections,” in Anti-fragile ICT Systems, Cham: Springer International Publishing, 2016, pp. 93–98. doi: 10.1007/978-3-319-30070-2_9.
D. P. Marius-Constantin Ilau, Adriam Baldwin, Tristan Caulfield, “Modelling and simulating organizational ransomware recovery: structure, methodology, and decisions,” J. Cybersecurity, vol. 11, no. 1, p. 45, 2025.
D. Manivannan, “A Comprehensive and Critical Analysis of Ransomware Detection, Prevention, Mitigation, and Recovery Approaches,” J. Cybersecurity, vol. 8, p. 397, 2026.
R. Kakadiya, K. Vora, A. Bambharoliya, and H. Kag, “AI-Driven Cyber Defense for Malware and Ransomware Protection,” in 2026 18th International Conference on Electronics, Computers and Artificial Intelligence (ECAI), IEEE, Jul. 2026, pp. 1–7. doi: 10.1109/ECAI69016.2026.11613710.
V. S. Vivek, V. Lokesh, T. Kaushik, U. Kumaran, B. Umah, and G. G. Devarajan, “Ransome Ware Detection Using Machine Learning and Deep Learning Models,” in Proceedings of International Conference on Recent Trends in Computing, R. P. Mahapatra, S. Roy, and P. Parwekar, Eds., Singapore: Springer Nature Singapore, 2025, pp. 105–117.
M. Rele, J. Samuel, D. Patil, and U. Krishnan, “Exploring Ransomware Detection Based on Artificial Intelligence and Machine Learning,” Procedia Comput. Sci., vol. 252, pp. 548–556, 2025, doi: 10.1016/j.procs.2025.01.014.
W. F. Elsersy, A. ElShamy, and M. Samy, “Ransomware Detection Using Machine Learning Algorithms,” in 2024 Intelligent Methods, Systems, and Applications (IMSA), IEEE, Jul. 2024, pp. 186–192. doi: 10.1109/IMSA61967.2024.10652659.
Most read articles by the same author(s)
- Dr. Mariam Al-Falasi, Dr. Tao Zhang, AUGMENTING SIEM WITH THREAT INTELLIGENCE FOR PREDICTIVE CYBER DEFENSE: A PROACTIVE THREAT HUNTING APPROACH , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 03 (2025): Volume 02 Issue 03
- Haruto Nakamura, Yui Takahashi, Adaptive Authentication Framework for Agentic AI Ecosystems: Protocol Design, Trust Evaluation, and Security Analysis , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Nguyen Minh Khoa, Tran Thi Lan Anh, Strategic Business Transformation through Data Analytics, Sustainable Practices, and Innovation Management , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Dr. Tanvi Das, James D. Walker, A FEDERATED MULTI-MODAL SYSTEM FOR INSIDER THREAT DETECTION IN ENERGY INFRASTRUCTURE USING BIOMETRIC AND CYBER DATA , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 01 (2025): Volume 02 Issue 01
- Prof. Emily Zhang, Luca Romano, DEFENDING AGAINST EVOLVING CYBER THREATS: A HYBRID FRAMEWORK FOR ATTACK PATTERN ANALYSIS AND INTELLIGENCE INTEGRATION , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 04 (2025): Volume 02 Issue 04
- Chinedu Okafor, Amina Yusuf Bello, A Strategic HR Framework for Reducing Employee Attrition and Enhancing Talent Acquisition in the Indian Banking Sector , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Julia H. Whitaker, PROACTIVE CYBER THREAT HUNTING AND PREDICTIVE INTELLIGENCE IN CLOUD-ENABLED CRITICAL INFRASTRUCTURE: AN INTEGRATED FRAMEWORK FOR RESILIENT DIGITAL ECOSYSTEMS , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 02 (2026): Volume 03 Issue 02
- Dr. Amara Ndlovu, Dr. Faisal Khan, CYBERSECURITY IN VIRTUAL GATHERINGS: RISKS AND REMEDIAL STRATEGIES FOR VIDEO CONFERENCING SOFTWARE , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 04 (2025): Volume 02 Issue 04
- Ms. Shivani Jain, A Survey on Deep Learning Approaches for Malware Detection and Classification , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Alistair C. Finch, From Reactive to Predictive: A Framework for Integrating Threat Intelligence with SIEM for Proactive Threat Hunting , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 10 (2025): Volume 02 Issue 10
Similar Articles
- Daniel Okonkwo, AI-Powered Adaptive Threat Intelligence and Risk Mitigation Framework for Secure SAP S/4HANA Manufacturing Integration , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Lukas Schneider, Anna Müller, A STRIDE-Based Cybersecurity Framework for Threat Detection in Federated Identity and Access Management Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Dr. Arjun Mehta, Dr. Priya Nair, Comprehensive Review of Modern Health Monitoring Technologies and Digital Healthcare Services , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 07 (2026): Volume 03 Issue 07
- Prof. Dmitry V. Volkov, Dr. Kofi Agyapong, ADAPTIVE TRUST BOUNDARY ENFORCEMENT: A COMPREHENSIVE REVIEW OF ZERO TRUST ARCHITECTURE IMPLEMENTATION AND USABILITY CHALLENGES , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 10 (2025): Volume 02 Issue 10
- Mr. Anoop Sunarty, AI-Driven Predictive Model for Osteoporosis Risk Assessment , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- John M. Callahan, Advancing Cyber Threat Intelligence Frameworks: Integrative Models, Sharing Mechanisms, and Predictive Analytics , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 07 (2025): Volume 02 Issue 07
- Dr. Elena Petrova, Research on Unusual Transmission Pattern Recognition in Telecommunication Infrastructure Using Fuzzy Equation Approach , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Muhammad Hamza Khan, Ayesha Noor Malik, AI Governance and Cybersecurity Policy in the Public Sector: Balancing National Security, Data Privacy, and Ethical Risk , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Elena Petrova, Dr. Hassan Al-Mansoori, EVALUATING AND ENHANCING CYBERSECURITY AND RESILIENCE IN HEALTHCARE: A UNIFIED RISK AND COMPLIANCE FRAMEWORK , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 05 (2025): Volume 02 Issue 05
- Dr. Samuel O. Adebayo, A Socio-Technical Approach to Mitigating Cybersecurity Risks in Industrial Control Systems: The Vulnerability Analysis Critical Impact Point (VACIP) Methodology , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 06 (2026): Volume 03 Issue 06
You may also start an advanced similarity search for this article.