Machine learning-based ransomware detection approaches
Abstract
The study aimed to analyze machine learning-based ransomware detection approaches in order to identify the most effective proposals reported in recent literature. The PRISMA methodology was applied to select original articles published between 2020 and 2025 in specialized databases. Findings show that traditional signature-based methods are insufficient against zero-day variants, while algorithms such as Random Forest, Gradient Boosting, and deep neural networks provide higher accuracy and adaptability. Likewise, hybrid and emerging approaches that incorporate forensic analysis with language models or explainable artificial intelligence stand out. It is concluded that machine learning techniques represent a robust and evolving alternative for early ransomware detection, contributing to strengthening the resilience of cybersecurity systems.
Downloads
References
K. Basu, P. Krishnamurthy, F. Khorrami y R. Karri, “A Theoretical Study of Hardware Performance Counters-Based Malware Detection,” IEEE Transactions on Information Forensics and Security, vol. 15, pp. 512-525, 2019. [Online]. Available: https://doi.org/10.1109/TIFS.2019.2924549 DOI: https://doi.org/10.1109/TIFS.2019.2924549
B. A. S. Al-rimy, M. A. Maarof y S. Z. M. Shaid, “Ransomware threat success factors, taxonomy, and countermeasures: A survey and research directions,” Computers & Security, vol. 74, pp. 144-166, 2018. [Online]. Available: https://doi.org/10.1016/j.cose.2018.01.001 DOI: https://doi.org/10.1016/j.cose.2018.01.001
D. M. Nicol, “The Ransomware Threat to Energy-Delivery Systems,” IEEE Security & Privacy, vol. 19, no. 3, pp. 24-32, 2021. [Online]. Available: https://doi.org/10.1109/MSEC.2021.3063678 DOI: https://doi.org/10.1109/MSEC.2021.3063678
C. Mingcan, F. Jiang y R. Doss, “RansoGuard: un marco basado en RNN que aprovecha las API sensibles previas al ataque para la detección temprana de ransomware,” Computadoras y seguridad, vol. 150, p. 104293, 2025. [Online]. Available: https://doi.org/10.1016/j.cose.2024.104293 DOI: https://doi.org/10.1016/j.cose.2024.104293
M. Rele, J. Samuel, D. Patil y U. Krishnan, “Explorando la detección de ransomware basada en inteligencia artificial y aprendizaje automático,” Procedia Ciencias de la Computación, vol. 252, pp. 548-556, 2025. [Online]. Available: https://doi.org/10.1016/j.procs.2025.01.014 DOI: https://doi.org/10.1016/j.procs.2025.01.014
P. O'Kane, S. Sezer y D. Carlin, “Evolution of ransomware,” IET Networks, vol. 7, no. 5, pp. 321-327, 2018. [Online]. Available: https://doi.org/10.1049/iet-net.2017.0207 DOI: https://doi.org/10.1049/iet-net.2017.0207
E. Berrueta, D. Morato, E. Magaña y M. Izal, “A Survey on Detection Techniques for Cryptographic Ransomware,” IEEE Access, vol. 7, pp. 144925-144944, 2019. [Online]. Available: https://doi.org/10.1109/ACCESS.2019.2945839 DOI: https://doi.org/10.1109/ACCESS.2019.2945839
B. Cui, Y. Hu, T. Qub, Y. He y L. Sun, “Un nuevo enfoque de detección de ransomware de día cero basado en CVAE y 1D-CNN,” Computación de alta confianza, vol. 5, no. 4, p. 100338, 2025. [Online]. Available: https://doi.org/10.1016/j.hcc.2025.100338 DOI: https://doi.org/10.1016/j.hcc.2025.100338
C. Mingcan, X. Deng, F. Jiang y R. Doss, “Zero-Ran Sniff: un método de detección temprana de ransomware de día cero basado en el aprendizaje de disparo cero,” Computadoras y seguridad, vol. 142, p. 103849, 2024. [Online]. Available: https://doi.org/10.1016/j.cose.2024.103849 DOI: https://doi.org/10.1016/j.cose.2024.103849
J. Von, C. Feng, A. Huertas, R. Oles, G. Bovet y B. Stiller, “GuardFS : un sistema de archivos para la detección y mitigación integradas de ransomware basado en Linux,” Revista de Seguridad de la Información y Aplicaciones, vol. 93, p. 104078, 2025. [Online]. Available: https://doi.org/10.1016/j.jisa.2025.104078 DOI: https://doi.org/10.1016/j.jisa.2025.104078
C. Beaman, A. Barkworth, T. D. Akande, S. Hakak y M. K. Khan, “Ransomware: Recent advances, analysis, challenges and future research directions,” Computers & Security, vol. 111, p. 102490, 2021. [Online]. Available: https://doi.org/10.1016/j.cose.2021.102490 DOI: https://doi.org/10.1016/j.cose.2021.102490
S. Razaulla, C. Fachkha, C. Markarian, A. Gawanmeh, W. Mansoor, B. Fung y C. Assi, “The Age of Ransomware: A Survey on the Evolution, Taxonomy, and Research Directions,” IEEE Access, vol. 11, pp. 40698-40723, 2023. [Online]. Available: https://doi.org/10.1109/ACCESS.2023.3268535 DOI: https://doi.org/10.1109/ACCESS.2023.3268535
J. Ispahany, R. Islam, Z. Islam y A. Khan, “Detección de ransomware mediante aprendizaje automático: una revisión, limitaciones de la investigación y futuras direcciones,” IEEE Xplore, vol. 12, pp. 68785-68813, 2024. [Online]. Available: https://doi.org/10.1109/ACCESS.2024.3397921 DOI: https://doi.org/10.1109/ACCESS.2024.3397921
I. Almomani, R. Qaddoura, M. Habib, S. Alsoghyer, A. A. Khayer, I. Aljarah y H. Faris, “Detección de ransomware en Android basada en un enfoque evolutivo híbrido en el contexto de datos altamente desequilibrados,” IEEE Access, vol. 9, pp. 57674-57691, 2021. [Online]. Available: https://doi.org/10.1109/ACCESS.2021.3071450 DOI: https://doi.org/10.1109/ACCESS.2021.3071450
A. Gajjar, P. Kashyap, A. Aysu, P. Franzon, Y. Choi, C. Cheng, G. Pedretti y J. Ignowski, “RD-FAXID: Detección de ransomware con XGBoost acelerado por FPGA,” ACM Digital Library, vol. 17, no. 4, pp. 1936-7406, 2024. [Online]. Available: https://doi.org/10.1145/3688396 DOI: https://doi.org/10.1145/3688396
A. Alvi y Z. Jalil, “XRGuard: Un enfoque independiente del modelo para la detección de ransomware mediante análisis dinámico e IA explicable,” IEEE Access, vol. 13, pp. 53159-53170, 2025. [Online]. Available: https://doi.org/10.1109/ACCESS.2025.3553562 DOI: https://doi.org/10.1109/ACCESS.2025.3553562
M. J. Page, J. E. McKenzie, P. M. Bossuyt, I. Boutron, T. C. Hoffmann, C. D. Mulrow, L. Shamseer, J. M. Tetzlaff, E. A. Akl, S. E. Brennan, R. Chou, J. Glanville, J. M. Grimshaw y A. Hróbjartsson, “Declaración PRISMA 2020: una guía actualizada para la publicación de revisiones sistemáticasThe PRISMA 2020 statement: an updated guideline for reporting systematic reviews,” Revista Española de Cardiología, vol. 74, no. 11, pp. 790-799, 2021. [Online]. Available: https://doi.org/10.1016/j.recesp.2021.06.016 DOI: https://doi.org/10.1016/j.rec.2021.07.010
A. Hossain, T. Hasan, F. Ahmed, S. Hasib, M. Hasan y A. Haque, “Hacia una detección superior de ransomware en Android: una perspectiva de aprendizaje automático conjunto,” Ciberseguridad y aplicaciones, vol. 1, p. 100076, 2025. [Online]. Available: https://doi.org/10.1016/j.csa.2024.100076 DOI: https://doi.org/10.1016/j.csa.2024.100076
M. Azeem, D. Khan, S. Iftikhar, S. Bawazeer y M. Alzahrani, “Análisis y comparación de la eficacia de la detección de malware: un estudio de enfoques de aprendizaje automático,” Heliyon, vol. 10, no. 1, p. 23574, 2024. [Online]. Available: https://doi.org/10.1016/j.heliyon.2023.e23574 DOI: https://doi.org/10.1016/j.heliyon.2023.e23574
M. Sibtain, M. Hussain, Q. Riaz, S. Qadir, N. Riaz y K.-H. Jung, “Detección de ransomware para Android robusta y ligera mediante análisis de comportamiento y reducción de características,” Computadoras, materiales y continua, vol. 84, no. 3, pp. 5177-5199, 2025. [Online]. Available: https://doi.org/10.32604/cmc.2025.066198 DOI: https://doi.org/10.32604/cmc.2025.066198
A. Arabo, R. Dijoux, T. Poulain y G. Chevalier, “Detecting Ransomware Using Process Behavior Analysis,” Procedia Computer Science, vol. 168, pp. 289-296, 2020. [Online]. Available: https://doi.org/10.1016/j.procs.2020.02.249 DOI: https://doi.org/10.1016/j.procs.2020.02.249
A. Almashhadani, D. Carlin, M. Kaiiali y S. Sezer, “MFMCNS: a multi-feature and multi-classifier network-based system for ransomworm detection,” Computers & Security, vol. 121, p. 102860, 2022. [Online]. Available: https://doi.org/10.1016/j.cose.2022.102860 DOI: https://doi.org/10.1016/j.cose.2022.102860
A. Singh, H. A. Abosaq, S. Arif, Z. Mushtaq, M. Irfan, G. Abbas, A. Ali y A. A. Mazroa, “Securing Cloud-Encrypted Data: Detecting Ransomware-as-a-Service (RaaS) Attacks through Deep Learning Ensemble,” Computers, Materials & Continua, vol. 79, no. 1, pp. 857-873, 2024. [Online]. Available: https://doi.org/10.32604/cmc.2024.048036 DOI: https://doi.org/10.32604/cmc.2024.048036
S. H. Kok, A. Abdullah y N. Z. Jhanjhi, “Early detection of crypto-ransomware using pre-encryption detection algorithm,” Journal of King Saud University - Computer and Information Sciences, vol. 34, no. 5, pp. 1984-1999, 2022. [Online]. Available: https://doi.org/10.1016/j.jksuci.2020.06.012 DOI: https://doi.org/10.1016/j.jksuci.2020.06.012
F. Khan, C. Ncube, L. K. Ramasamy, S. Kadry y Y. Nam, “A Digital DNA Sequencing Engine for Ransomware Detection Using Machine Learning,” IEEE Access, vol. 8, pp. 119710-119719, 2020. [Online]. Available: https://doi.org/10.1109/ACCESS.2020.3003785 DOI: https://doi.org/10.1109/ACCESS.2020.3003785
M. L. Hernandez-Jaimes, A. Martínez-Cruz, K. A. Ramírez-Gutiérrez y E. Guevara-Martínez, “Enhancing Machine Learning Approach Based on Nilsimsa Fingerprinting for Ransomware Detection in IoMT,” IEEE Access, vol. 12, pp. 153886-153897, 2024. [Online]. Available: https://doi.org/10.1109/ACCESS.2024.3480889 DOI: https://doi.org/10.1109/ACCESS.2024.3480889
M. Al-Hawawreh, E. Sitnikova y N. Aboutorab, “Asynchronous Peer-to-Peer Federated Capability-Based Targeted Ransomware Detection Model for Industrial IoT,” IEEE Access, vol. 9, pp. 148738-148755, 2021. [Online]. Available: https://doi.org/10.1109/ACCESS.2021.3124634 DOI: https://doi.org/10.1109/ACCESS.2021.3124634
D. B. Oh, D. Kim, D. Kim y K. H. Kim, “volGPT: Evaluation on triaging ransomware process in memory forensics with Large Language Model,” Forensic Science International Digital Investigation, vol. 49, p. 301756, 2024. [Online]. Available: https://doi.org/10.1016/j.fsidi.2024.301756 DOI: https://doi.org/10.1016/j.fsidi.2024.301756
H. Kabuye, B. Issac, R. Yumlembam y J. Neera, “Explainable and Uncertainty Aware AI-Based Ransomware Detection,” IEEE Access, vol. 13, pp. 106573-106589, 2025. [Online]. Available: https://doi.org/10.1109/ACCESS.2025.3581424 DOI: https://doi.org/10.1109/ACCESS.2025.3581424
J. E. Hill, T. O. Walker, J. A. Blanco, R. W. Ives, R. Rakvic y B. Jacob, “Ransomware Classification Using Hardware Performance Counters on a Non-Virtualized System,” IEEE Access, vol. 12, pp. 63865-63884, 2024. [Online]. Available: https://doi.org/10.1109/ACCESS.2024.3395491 DOI: https://doi.org/10.1109/ACCESS.2024.3395491
U. Tariq, “Combatir el ransomware en entornos de IoT industriales activados por ZephyrOS,” Heliyon, vol. 10, no. 9, p. e29917, 2024. https://doi.org/10.1016/j.heliyon.2024.e29917 DOI: https://doi.org/10.1016/j.heliyon.2024.e29917
Contribution of this article to the SDG.
Copyright (c) 2026 Innovation and Software
This work is licensed under a Creative Commons Attribution 4.0 International License.
The authors exclusively grant the right to publish their article to the Innovation and Software Journal, which may formally edit or modify the approved text to comply with their own editorial standards and with universal grammatical standards, prior to publication; Likewise, our journal may translate the approved manuscripts into as many languages as it deems necessary and disseminates them in several countries, always giving public recognition to the author or authors of the research.
