Machine Learning-Based Framework for Ransomware Detection and Classification

Abstract

Ransomware has become one of the most dangerous cybersecurity threats, causing significant financial losses and compromising sensitive data across individuals and organizations. Traditional signature-based detection techniques are often ineffective against newly emerging and evolving ransomware variants. Consequently, Machine Learning (ML) has gained considerable attention as an effective approach for identifying ransomware based on behavioral patterns and system activities. This literature survey reviews recent research on ransomware detection using machine learning techniques. It analyzes various detection methods, datasets, feature extraction approaches, and machine learning algorithms such as Decision Trees, Random Forest, Support Vector Machines (SVM), K-Nearest Neighbors (KNN), Naïve Bayes, Artificial Neural Networks (ANN), and deep learning models. The survey compares the performance of these techniques using evaluation metrics including accuracy, precision, recall, and F1-score. Furthermore, this survey highlights the strengths and limitations of existing approaches, discusses the challenges involved in detecting zero-day ransomware attacks, handling imbalanced datasets, and achieving real-time detection. It also identifies current research gaps and explores future directions, including explainable artificial intelligence (XAI), federated learning, and lightweight machine learning models for edge and cloud environments.