In this subsection, we comparatively analyze ransomware detection approaches that infer attacks from abnormal runtime behavior. Across the literature, the central intuition is consistent: ransomware must eventually interact with system resources–especially files, processes, APIs, registry entries, memory, or the desktop–in ways that differ from benign software. The main differences among existing works lie in where they monitor behavior (user level, API level, kernel/hypervisor level), how early they aim to detect the attack (pre-encryption vs. during encryption), and what trade-offs they make among detection speed, robustness, overhead, and deployability.

Early systems such as CryptoDrop [26] and UNVEIL [27] established the practical feasibility of behavior-based ransomware detection. Both exploit the observation that ransomware must manipulate user files or desktop artifacts to achieve its objective, but they do so differently. CryptoDrop emphasizes online early warning through correlated file-access indicators and rapid process termination, making it particularly valuable for limiting damage. UNVEIL, in contrast, relies on a synthetic execution environment to observe suspicious file and desktop manipulations, offering richer behavioral visibility but under more controlled conditions. Works such as Chen and Bridges [28] and Homayoun et al. [29] extend this line of research by showing that execution traces are not only useful for detection, but also for extracting discriminative behavioral patterns and even attributing activity to ransomware families. The key insight from these early studies is that runtime behavior provides stronger semantic signals than purely static artifacts, although many results still depend on controlled experimental settings.

A major subsequent research direction centers on Windows API-call analysis, which offers a more fine-grained and machine-learning-ready behavioral representation. Hampton et al. [30] show that API-call frequencies already provide meaningful separation between ransomware and benign processes, while later studies improve on this idea through richer modeling choices. For example, PEDA and its extensions [31,32] emphasize pre-encryption detection by combining fast hashing with API-based learning, reflecting a design choice that prioritizes early intervention over deeper but slower analysis. Hwang et al. [33] capture sequential dependencies through Markov modeling, Ullah et al. [34] and Molina et al. [35] show that compact feature representations can capture reconnaissance and evasion behavior, and Herrera-Silva and Hernández-Álvarez [36] strengthen the empirical side of the literature through more recent cross-dataset evaluations. Compared with earlier log-driven methods, API-centric approaches generally offer better granularity and are easier to integrate with learning pipelines, but they are also more exposed to adversarial API obfuscation, delayed execution, and runtime overhead. Thus, their main strength is sensitivity to fine behavioral patterns, whereas their main weakness is brittleness under adaptive attackers.

Another important branch of the literature moves the observation point deeper into the system stack to improve tamper resistance and capture lower-level signals. Javaheri et al. [37] and Zhang et al. [38] use kernel-level instrumentation, while Tang et al. [39] employ virtual machine introspection below the guest OS, and McIntosh et al. [40] explore dynamic user-driven access control as a means of intercepting suspicious file accesses. Compared with user-level or API-level monitoring, these approaches are generally more resistant to evasion and privilege manipulation, and they can sometimes detect attacks earlier in the execution chain. However, that improved robustness comes at the cost of substantially greater deployment complexity, privileged integration requirements, and potential portability challenges. The broader lesson is that deeper visibility often improves resilience, but also makes real-world adoption harder.

Several works focus specifically on detecting ransomware before substantial encryption begins, highlighting a recurring tension between earliness and evidence quality. Kok et al. [32] and Al Sabeh et al. [41] target environment-inspection and reconnaissance APIs to stop attacks before encryption starts, while Ramesh and Menen [42] model ransomware progression as a finite-state machine across multiple families. Abbasi et al. [43] improve efficiency through optimized behavioral feature selection, and Ayub et al. [44] combine dynamic analysis with prior knowledge from static ML models to improve early detection of previously unseen samples. Taken together, these studies show that pre-encryption detection is attractive because it can significantly reduce damage, but it also relies on the assumption that early-stage malicious behaviors are both observable and sufficiently distinct from benign activity. This assumption is increasingly strained by stealthy, low-and-slow, or staged ransomware.

More recent work reflects a shift from proof-of-concept detection toward operational scalability, transparency, and deployment realism. Hou et al. [45] address a longstanding weakness in the literature, namely, small and unrealistic datasets, by constructing MarauderMap, a multi-terabyte runtime dataset spanning multiple attack stages, which enables more realistic analysis of ransomware behavior across reconnaissance, tampering, exfiltration, and encryption phases. Marcinkowski et al. [46] respond to the interpretability gap by proposing MIRAD, which uses interpretable machine learning over API and registry behaviors, while Wang et al. [47] emphasize deployment practicality through CanCal, a lightweight industrial-scale pipeline that filters candidate processes before applying more expensive behavioral analysis. Compared with earlier sandbox-oriented systems, these recent approaches are less concerned with demonstrating mere detectability and more focused on scalability, explainability, and low false-positives. This marks an important maturation of the field.

Open Issues: Behavioral and runtime-based detection approaches fundamentally rely on the assumption that ransomware exhibits observable pre-encryption activity patterns. However, modern ransomware increasingly adopts stealthy, delayed, or low-and-slow encryption strategies that minimize detectable anomalies. Kernel- and API-level monitoring further introduces runtime overhead and scalability concerns, particularly in cloud and resource-constrained environments. Additionally, these approaches are rarely evaluated under adversarial conditions, where attackers may mimic benign processes or inject noise into behavioral traces, limiting robustness in real-world deployments. These limitations directly relate to challenges C2 (adversarial robustness), C5 (efficiency), and C10 (evolving threat models).

Classical machine learning (ML) has been widely adopted for ransomware detection due to its ability to learn discriminative patterns from heterogeneous data while maintaining relatively low computational overhead. Across the literature, the key design differences lie in the choice of feature modality (static, behavioral, memory), the degree of feature engineering, and the integration with system-level defenses. These choices directly influence robustness, deployability, and generalization.

Early works explore diverse feature spaces, highlighting a fundamental trade-off between visibility and robustness. Static-analysis approaches (e.g., opcode N-grams with TF-IDF weighting [48]) are computationally efficient and easy to deploy, but are inherently fragile under packing and obfuscation. In contrast, behavioral and screen-content–based methods [49] attempt to capture runtime semantics, improving resilience to code transformation at the cost of requiring dynamic analysis environments. Memory-forensics–based approaches [50,51] provide even deeper visibility into execution artifacts and can detect fileless or previously unseen ransomware, but introduce significant monitoring overhead and deployment complexity. While these works show that carefully engineered features combined with classifiers such as Random Forest or XGBoost can achieve high reported accuracy, their effectiveness is tightly coupled to the observability and stability of the chosen feature space.

A second line of work focuses on behavioral sequence modeling and feature optimization, revealing that feature engineering often matters more than model complexity. Studies modeling API-call sequences and process behaviors [52–54] demonstrate that incorporating temporal structure improves detection fidelity compared to simple frequency-based features. Techniques such as Enhanced Maximum-Relevance and Minimum-Redundancy (EmRMR), Principle Component Analysis (PCA), and bio-inspired representations (e.g., digital DNA k-mers) further reduce redundancy and enhance discriminative power. Notably, works such as Jain et al. [55] show that well-designed feature-selection pipelines can allow classical models to match or even outperform deep learning methods. The key insight here is that classical ML remains competitive not because of model sophistication, but because of efficient and domain-aware feature representations. However, these approaches remain vulnerable to adversarial manipulation of behavioral features and to concept drift in evolving ransomware.

Another important trend is the integration of ML with cross-layer or system-level defenses. Approaches such as the one proposed by Fernandez Maimo et al. [56] embed ML detection within SDN/NFV-enabled architectures to enable rapid isolation, while Poudyal and Dasgupta [57] and Iqbal et al. [58] combine multi-level and multimodal features (DLL, function calls, assembly, text, images) to improve detection coverage and support family attribution. Compared to standalone classifiers, these systems offer better contextual awareness and response capability, but at the cost of more complex feature pipelines and tighter integration requirements. This highlights a recurring trade-off between detection accuracy and system complexity.

Recent work shifts the focus from accuracy-centric evaluation to scalability and deployment realism. Stream-based learning approaches [59] address latency constraints in real-time environments, while comparative studies [60] demonstrate that classical ML remains competitive with deep learning when properly tuned. Expanding beyond endpoint detection, blockchain analytics [61] illustrate the applicability of ML to ransomware-related financial activity. Importantly, Rios-Ochoa et al. [62] show that models achieving near-perfect offline accuracy often degrade significantly in live deployments, exposing the gap between laboratory evaluation and operational performance. Open Issues: Classical ML-based approaches depend heavily on handcrafted features, which are inherently vulnerable to obfuscation, polymorphism, and feature manipulation by adaptive ransomware. Many studies rely on curated and balanced datasets, resulting in limited generalization under real-world class imbalance and evolving attack distributions. Furthermore, issues such as concept drift, feature instability, and lack of cross-dataset validation remain insufficiently addressed. Adversarial machine learning threats, including evasion and poisoning attacks, are also largely overlooked in existing evaluations. These issues highlight challenges C1 (dataset realism), C2 (adversarial robustness), and C3 (generalization and drift).

In recent years, deep learning (DL) has become a prominent paradigm for ransomware detection due to its ability to automatically learn hierarchical representations from raw or minimally processed data. Unlike classical ML approaches that rely heavily on handcrafted features, DL-based methods shift the design focus toward representation learning, enabling models to capture complex temporal, structural, and semantic patterns. However, this shift also introduces new trade-offs related to data dependence, computational cost, interpretability, and robustness.

A dominant line of work models ransomware behavior as temporal sequences, particularly using API calls, system events, or execution traces. Hybrid CNN–RNN architectures such as DRTHIS [63] and more recent systems like RansoGuard [64] and iCNN-LSTM+ [65] demonstrate that combining spatial feature extraction (CNNs) with temporal modeling (LSTMs or attention) improves detection of both known and unseen ransomware variants. These approaches emphasize early-stage detection by capturing pre-encryption behaviors and adapting incrementally to evolving threats. Compared to classical ML, they offer greater expressive power and reduced reliance on manual feature engineering. However, this advantage comes at the cost of higher computational overhead, more complex training pipelines, and increased vulnerability to adversarial manipulation of event sequences. Thus, DL-based sequence models trade feature engineering effort for data and compute dependence.

A parallel research direction focuses on advanced representation learning from static or hybrid artifacts. Self-attention-based models (e.g., Zhang et al. [66]) address the limitations of RNNs in handling long opcode sequences by capturing global dependencies more efficiently, while image-based approaches (e.g., RansomShield [67]) transform binaries into visual representations that CNNs can process. Hybrid systems such as SwiftR [68] combine static intermediate representations with dynamic behavioral embeddings, aiming to improve generalization to unknown families. These approaches highlight DL’s flexibility in handling diverse data modalities and learning high-level abstractions. However, compared to behavioral sequence models, static and image-based methods remain more susceptible to obfuscation, packing, and adversarial perturbations, revealing a key trade-off between representation richness and robustness.

To address data scarcity and improve generalization, recent works incorporate generative and data-efficient learning techniques. GAN-based frameworks (e.g., TGAN-IDS [69], BGM-GAN [70]) synthesize realistic ransomware behaviors to enhance detection of early-stage or unseen attacks, while few-shot and meta-learning approaches [71] aim to reduce dependence on large labeled datasets. These methods represent a shift toward data-centric robustness, attempting to bridge the gap between limited training data and evolving threat landscapes. However, GAN-based systems introduce training instability and additional complexity, and their effectiveness depends on how well the generated samples reflect real-world attack distributions.

Another emerging trend is the movement toward scalable and deployment-aware DL systems. Approaches such as DeepWare [72] and VM-level monitoring frameworks [73] leverage hardware performance counters and low-level telemetry to enable efficient detection with reduced overhead. Federated learning frameworks [74] extend DL-based detection across distributed environments, addressing data privacy and heterogeneity, while large-scale empirical systems [75] demonstrate cross-domain applicability in mobile and network settings. Compared to earlier prototype models, these systems prioritize scalability and real-world deployment, but introduce new challenges such as communication overhead, Non-Independent and Identically Distributed (non-IID) data handling, and vulnerability to poisoning attacks.

Finally, explainability and trustworthiness have emerged as critical concerns for DL-based detection. Frameworks such as XRan [76] and recent hybrid models [77] integrate XAI techniques (e.g., SHAP, LIME) and uncertainty estimation to improve transparency and analyst trust. While these efforts address the black-box nature of DL-based models, they remain limited by the lack of standardized evaluation for explanation fidelity and by potential adversarial manipulation of explanations themselves. This reflects a broader trade-off between model complexity and interpretability.

Open Issues: DL-based ransomware detection methods require large volumes of labeled data and incur significant computational overhead, limiting their applicability in real-time and resource-constrained environments. These models are also susceptible to adversarial examples and traffic manipulation, which can distort learned representations. Moreover, the lack of interpretability and inconsistent evaluation of explanation fidelity raises concerns about trust and usability in operational settings. Cross-dataset generalization and robustness to evolving ransomware behaviors remain open challenges. These challenges correspond to C2 (adversarial robustness), C4 (explainability), and C5 (computational efficiency).

Semi-supervised, zero-shot, and drift-aware ransomware detection approaches are motivated by a common limitation of supervised methods, namely, their dependence on large labeled datasets and their inability to generalize to unseen or evolving ransomware variants. While all three paradigms aim to improve adaptability, they differ in how they address uncertainty: semi-supervised methods leverage unlabeled data, zero-shot approaches rely on abstract representations, and drift-aware systems explicitly model temporal evolution.

Semi-supervised approaches primarily seek to bridge the gap between limited labeled dataset and abundant unlabeled observations. For example, Sharmeen et al. [78] combine unsupervised representation learning with supervised classification to improve adaptability, whereas Urooj et al. [79] extend this idea using GAN-based augmentation to explicitly model evolving ransomware behavior over time. Compared to fully supervised methods, these approaches improve robustness to unseen variants by leveraging latent structure in data. However, their effectiveness critically depends on the representativeness of unlabeled or synthesized data, which is often difficult to guarantee in practice. Thus, they trade improved coverage of unknown threats for increased training complexity and potential sensitivity to distribution bias.

A complementary line of work focuses on early-stage detection under weak or sparse signals, highlighting the importance of feature quality over model complexity. The DPBD-FE and subsequent EMIFS/MM-EMIFS frameworks [80,81] emphasize dynamic identification of the pre-encryption boundary and adaptive feature selection tailored to early runtime behavior. Compared to generic feature extraction pipelines, these approaches detect the onset of encryption by monitoring cryptography-related API calls, demonstrating that careful feature engineering can significantly enhance performance even under limited signal conditions. However, their reliance on observable pre-encryption behavior introduces a key vulnerability: stealthy or delayed-encryption ransomware can bypass such assumptions, exposing a trade-off between early detection and behavioral visibility.

Zero-shot and drift-aware approaches further generalize detection to previously unseen ransomware and evolving environments, but through different mechanisms. Zero-shot methods such as Zero-Ran Sniff (ZRS) [82] abstract ransomware behavior into high-level attributes using autoencoders and attention mechanisms, enabling detection without family-specific training data. In contrast, drift-aware systems such as FeSAD [83] focus on maintaining performance over time by explicitly modeling and adapting to changes in data distribution. Moreover, FeSAD is designed to detect evolutionary ransomware under concept drift by integrating feature selection, drift calibration, and drift decision layers to enable reliable classification in non-stationary environments. While zero-shot learning emphasizes generalization across classes, drift-aware methods emphasize stability across time. Both represent a shift away from static models, yet they face a shared challenge: distinguishing benign distributional changes from adversarial evolution. Moreover, their evaluation is often limited to controlled or short-term settings, leaving long-term robustness uncertain.

Open Issues: Semi-supervised and zero-shot detection approaches aim to address data scarcity but depend heavily on the quality and representativeness of unlabeled or synthetic data. Existing attribute-based or embedding-based representations often fail to capture evolving ransomware semantics and multi-stage attack behaviors. Additionally, these methods lack long-term evaluation under realistic threat evolution scenarios, and their robustness against adversarial manipulation or poisoning of unlabeled data remains largely unexplored. These limitations relate to C1 (dataset realism), C3 (generalization), and C10 (emerging threat models).

Network- and SDN-based ransomware detection approaches exploit visibility of data at traffic-level and centralized control to identify and contain attacks at the network layer. Unlike host-based methods, these approaches provide global visibility and rapid response, but offer limited insight into host-level semantics.

SDN-based frameworks (e.g., [84–86]) leverage programmable control planes to detect and block ransomware by analyzing communication patterns and dynamically enforcing flow rules. Their works focus on detecting specific ransomwares (CryptoWall, and WannaCry). Their key advantage lies in real-time containment and network-wide enforcement. However, they rely on the assumption that ransomware exhibits identifiable and stable communication signatures, which is increasingly invalid due to encryption, proxying, and domain fronting.

In contrast, passive traffic-analysis approaches (e.g., [87–90]) focus on statistical and flow-level features to enable scalable and lightweight detection across enterprise and IoT environments. They [88,89] also focus on specific ransomwares–Locky, LooCipher. These methods are easier to deploy and do not require SDN infrastructure, but their effectiveness degrades when malicious traffic is encrypted, tunneled, or indistinguishable from benign flows. Thus, they trade scalability and deployability for reduced robustness.

Some works expand the threat model by considering unconventional communication channels such as blockchain-based C&C (e.g., [91]) coordination mechanism used by the Cerber ransomware and routing-level anomalies (e.g., [92]) by analyzing routing records from the WestRock ransomware event. These approaches improve coverage against stealthy coordination strategies but introduce significant monitoring complexity and depend on infrastructure-level data that may not be available in practice.

Open Issues: Network-based detection approaches face significant visibility limitations due to the widespread use of encryption and the adoption of covert C&C channels leveraging cloud services, P2P networks, or blockchain infrastructure. Anomaly-based methods often suffer from high false positive rates and lack contextual correlation with host-level activities. SDN-based mitigation strategies further require tight integration with network infrastructure, raising deployment complexity and scalability concerns in large-scale environments. These issues reflect challenges C6 (deployment constraints), C7 (cross-layer coordination), and C10 (evolving attack channels).

Ransomware detection in mobile environments differs fundamentally from desktop settings due to resource constraints, limited system visibility, and strict privacy controls. As a result, existing approaches can be broadly categorized into behavioral/runtime, static/API-based, and hybrid methods, each offering distinct trade-offs between accuracy, efficiency, and robustness.

Behavioral and runtime monitoring approaches focus on detecting anomalous system activity such as file encryption, system calls, or user–application interaction mismatches. Early systems (e.g., [93–95]) emphasize real-time detection and damage prevention by continuously monitoring processor usage, memory consumption, unauthorized encryption and I/O activity of critical processes and directories, while more recent methods (e.g., [96,97]) improve efficiency through lightweight streaming models and compiler-assisted instrumentation. These approaches provide strong semantic visibility and early detection capability, but incur runtime overhead and must carefully balance detection accuracy with battery consumption and user experience.

In contrast, static and API-based techniques (e.g., [98–100]) prioritize efficiency and scalability by analyzing permissions, API usage, and code structure prior to execution. These methods are well-suited for on-device deployment and large-scale screening, but are inherently fragile under code obfuscation, packing, and dynamic payload loading. Thus, they trade efficiency for reduced robustness compared to behavioral approaches.

Hybrid and traffic-based methods (e.g., [101–104]) combine static, dynamic, and network-level features to improve generalization across diverse ransomware variants. While these approaches enhance detection robustness and coverage, they introduce higher computational complexity and are less suitable for strictly resource-constrained environments. Similarly, formal and recovery-oriented solutions [105,106] extend beyond detection to provide stronger guarantees or post-attack recovery, but often require deeper system integration.

Overall, the comparison reveals a fundamental trade-off in mobile ransomware detection: efficiency vs. robustness vs. visibility. These challenges are further exacerbated by platform constraints such as limited energy, restricted monitoring capabilities, and rapid malware evolution, highlighting the need for lightweight, privacy-preserving, and adaptively robust detection frameworks tailored to mobile ecosystems.

Open Issues: Mobile ransomware detection remains constrained by limited resources, privacy restrictions, and restricted system visibility. Static methods struggle against obfuscation and dynamic loading, while runtime approaches incur non-trivial overhead. Encrypted traffic and evolving attack strategies further limit detection effectiveness, particularly against zero-day variants. These challenges align with C5 (efficiency), C6 (deployment), and C10 (platform-specific threats).

Ransomware detection in IoT/IIoT/CPS and healthcare environments differs fundamentally from traditional IT systems due to extreme resource constraints, heterogeneity, and safety-critical requirements. Existing approaches can be broadly categorized into lightweight behavioral detection, federated/distributed learning, and domain-specific resilience mechanisms, each reflecting different trade-offs between efficiency, scalability, and robustness.

Lightweight behavioral and hybrid approaches (e.g., [107,108]) exploit low-level telemetry (e.g., kernel activity, device signals) to enable early detection with minimal overhead. These methods are well-suited for resource-constrained IIoT edge gateways, but struggle with scalability and cross-device heterogeneity in large deployments.

Federated and distributed learning frameworks (e.g., [109,110]) address data heterogeneity and privacy constraints of IoT/IoMT networks by enabling collaborative detection across devices without centralized data collection. Compared to standalone models, they improve adaptability and coverage, but introduce communication overhead, synchronization complexity, and vulnerability to poisoning attacks.

Domain-specific approaches (e.g., [111,112]) integrate additional mechanisms such as blockchain, fog computing, and economic modeling to enhance resilience in safety-critical systems such as smart healthcare systems and vehicle ecosystems. These methods extend beyond detection to address integrity, traceability, and operational continuity, but significantly increase architectural complexity and may impact real-time performance.

Overall, the comparison reveals a fundamental trade-off in ICE/IoMT ransomware detection: efficiency vs. scalability vs. resilience. Lightweight methods prioritize deployability but lack global coordination, federated approaches improve adaptability but add system complexity, and domain-specific solutions enhance resilience at the cost of overhead. These challenges are further compounded by limited visibility into encrypted industrial protocols and the need to maintain safety and regulatory compliance, highlighting the importance of cross-layer, resource-aware, and deployment-specific defense strategies.

Open Issues: Detection in IoT/IIoT/CPS remains constrained by limited resources, heterogeneity, and safety requirements. Many approaches fail to scale across diverse devices and protocols, while federated methods introduce risks such as poisoning and privacy leakage. Restricted visibility into encrypted industrial traffic further limits effectiveness. These challenges align with C5 (scalability), C6 (deployment), and C7 (cross-layer coordination).

Ransomware evasion can be broadly categorized into inference-time evasion (manipulating runtime behavior to bypass detectors) and poisoning attacks (corrupting training data to degrade model performance). Across the literature, these strategies expose a fundamental limitation: most detection systems implicitly assume that malicious behavior remains sufficiently distinct from benign activity.

Early studies demonstrate the fragility of existing defenses. Works such as [113,114] show that both signature-based and behavioral detectors can be bypassed through carefully crafted execution patterns, including distributing malicious actions across processes. These results reveal that behavioral distinctiveness alone does not guarantee robustness, especially under adaptive attackers.

More recent work shifts toward intelligent and adaptive evasion. Frameworks such as RansomAI [115] and Animagus [116] demonstrate that ransomware can actively optimize its behavior, either by tuning encryption strategies or mimicking benign I/O patterns, to minimize detection probability. Compared to earlier heuristic evasion, these approaches represent a transition to learning-driven adversaries, significantly challenging ML/DL-based detectors.

In response to this, defensive efforts increasingly focus on identifying invariant signals that are difficult to conceal, such as the coupling between encryption operations and disk I/O (e.g., [117,118]). Zhao et al. [117] ERW-Radar system integrates contextual correlation, fine-grained content analysis, and adaptive optimization mechanisms, while Guo et al. [118] approach is based on the inherent temporal correlation between encryption computation and disk I/O activity. While these methods improve robustness against mimicry, they rely on assumptions about fundamental encryption behavior, which may be weakened by throttling, partial encryption, or distributed execution.

Finally, recent frameworks (e.g., Minerva [119]) integrate adversarial robustness directly into model design, moving from reactive to proactive defense. However, such approaches remain limited by the lack of standardized adversarial benchmarks and comprehensive evaluation under realistic attack conditions.

Overall, the comparison highlights an ongoing arms race: attackers evolve from static obfuscation to adaptive, learning-driven evasion, while defenders shift from heuristic detection to invariant-based and adversarially robust models. The key insight is that robustness cannot be achieved through feature design alone; it requires adversarially aware training, cross-layer signals, and continuous adaptation.

Open Issues: Adversarial robustness remains a major gap. Detection systems are vulnerable to mimicry, temporal distribution of malicious actions, and feature manipulation. Adversarial training, robustness benchmarks, and evaluation under realistic attack scenarios remain limited, while poisoning and model-extraction threats are underexplored. These challenges correspond to C2 (adversarial robustness) and C3 (generalization).

Table 5 provides a summary of common ransomware evasion strategies and representative defensive countermeasures. Table 6 provides a mapping of some of the ransomware evasion studies, to adversarial ML threat models.

In contrast, semi-supervised, zero-shot, and drift-aware approaches attempt to address the limitations of static models by improving adaptability to unseen and evolving threats. However, these methods shift the challenge from feature design to representation reliability and data realism, and they remain sensitive to distribution bias and adversarial drift.

Overall, the comparison highlights a fundamental insight: no single approach is sufficient under realistic ransomware threat models. Instead, effective defense requires a cross-layer, adaptive framework that combines complementary strengths–early detection (behavioral), pattern learning (ML/DL), resilience (storage), and adaptability (semi-supervised/zero-shot/drift-aware)–while explicitly accounting for adversarial behavior, dataset limitations, and deployment constraints.

Ransomware operators exploit the pseudonymity of cryptocurrencies to conduct difficult-to-trace financial transactions, motivating research on identifying attacker-controlled addresses and analyzing transaction flows. Existing approaches can be broadly categorized into heuristic/graph-based analysis, learning-based detection, and ecosystem-level studies, each offering different trade-offs between interpretability, scalability, and attribution accuracy.

Early works (e.g., [120–122]) rely on address clustering heuristics and transaction graph analysis to quantify ransomware payments and identify attacker-controlled entities. These methods provide valuable macro-level insights into the economic structure of ransomware campaigns and are relatively interpretable, but depend on simplifying assumptions about address reuse and transaction patterns, limiting their robustness under evasion techniques.

More recent approaches adopt learning-based frameworks (e.g., [61,123]) to improve scalability and generalization. By leveraging graph-based feature aggregation and semi-supervised or imbalance-aware learning, these methods can detect both known and previously unseen ransomware-related transactions. Compared to heuristic approaches, they offer improved detection performance, but are highly dependent on labeled data quality, graph construction accuracy, and feature design, and may suffer from reduced interpretability.

A complementary line of work focuses on ecosystem-level analysis (e.g., [124]), integrating blockchain data with incident-level and economic information to study long-term trends such as payment behaviors and double-extortion strategies. While these approaches provide broader contextual understanding, they are less suited for real-time detection and rely on aggregated or delayed data.

Overall, the comparison reveals a key trade-off: heuristic methods are interpretable but brittle, learning-based methods are scalable but data-dependent, and ecosystem-level analyses are comprehensive but largely retrospective. A fundamental limitation across all approaches is the difficulty of linking pseudonymous blockchain activity to real-world actors, particularly in the presence of mixers, cross-chain transactions, and privacy-enhancing techniques.

Open Issues: Accurate attribution remains challenging due to obfuscation techniques such as mixers, tumblers, and cross-chain transfers. The lack of high-quality labeled datasets and limited visibility into off-chain transactions further constrain detection and forensic analysis. These issues correspond to C1 (data limitations) and C9 (economic and policy factors).

Critical Insights and Lessons Learned: A comparative analysis of existing ransomware detection approaches reveals several important trends, contradictions, and unresolved limitations across the literature. First, although many ML- and DL-based approaches report very high detection accuracy, these results are often obtained using curated, static, and highly imbalanced datasets under controlled laboratory settings. In contrast, studies that evaluate models under more realistic conditions–such as temporal drift, cross-family testing, or zero-day scenarios–typically report substantially lower robustness and generalization capability. This suggests that the apparent superiority of many learning-based methods may partly reflect dataset bias and experimental design rather than true operational effectiveness.

Second, there exists a clear contradiction between early-detection objectives and stealth-resistant detection requirements. Several behavioral and runtime-monitoring approaches assume that ransomware exhibits rapid and observable pre-encryption activities such as burst file modifications, entropy changes, or intensive API calls. However, recent ransomware families increasingly adopt delayed execution, partial encryption, intermittent encryption, and low-and-slow strategies specifically designed to evade such assumptions. As a result, approaches optimized for rapid detection may suffer from high false positives, whereas more conservative systems often detect the attack too late to prevent significant damage. This highlights a fundamental trade-off between detection speed, accuracy, and damage prevention.

Third, cross-study comparison shows that no single detection paradigm provides comprehensive coverage against the evolving ransomware threat landscape. Behavioral approaches capture runtime anomalies but are sensitive to workload variability; network-based methods can identify C&C communication but may fail against offline or encrypted attacks; memory- and storage-level techniques can detect low-level malicious activities but often incur deployment overhead; and ML/DL methods are effective at pattern recognition yet remain vulnerable to adversarial evasion, poisoning, and feature manipulation attacks. Collectively, these findings indicate that ransomware defense cannot rely on a single-layer solution and instead requires cross-layer, multi-modal, and adaptive frameworks that combine host-, network-, memory-, and storage-level visibility.

Another important insight is the growing gap between research prototypes and deployment feasibility. Many studies optimize primarily for detection performance while overlooking practical operational constraints such as latency, computational overhead, scalability, privacy concerns, explainability, interoperability, and false alarm management. This issue becomes even more pronounced in resource- constrained environments such as IoT, IIoT, CPS, and edge systems, where heavyweight monitoring and complex deep learning models may not be practical. Furthermore, explainability and analyst trust remain underexplored despite their importance in operational SOC and incident response environments.

Finally, current evaluation methodologies remain fragmented and inconsistent across studies. Different works use different datasets, feature sets, attack scenarios, and performance metrics, making direct comparison difficult. Moreover, many evaluations ignore adversarial settings, longitudinal behavior changes, and realistic deployment conditions. These inconsistencies hinder reproducibility and may inflate perceived effectiveness. Overall, the surveyed literature suggests that future ransomware detection systems must move beyond isolated accuracy-driven designs toward robust, adaptive, deployment-aware, and explainable solutions evaluated using realistic, standardized, and continuously updated benchmarks.

Table 7 presents a classification of the ransomware detection approaches, along with the detection principle used with representative references, discussed in this subsection.

Unified Insights: Table 8 shows that no single defense paradigm is sufficient under realistic ransomware threat models. Behavioral and learning-based methods are valuable for early detection, but they often degrade under stealthy, adaptive, or distribution-shifted attacks. Network-based approaches provide broader visibility but may miss host-local encryption activity, while storage-level and backup-based mechanisms improve resilience yet often operate after some damage has already occurred. These comparisons highlight fundamental trade-offs between accuracy and latency, detection and prevention, interpretability and model complexity, and broad coverage and deployment cost. Consequently, robust ransomware defense requires cross-layer, defense-in-depth designs that combine early detection, damage containment, and recovery support.

This subsection focuses on storage-level and hardware-assisted defenses against ransomware. These approaches operate below the application and operating-system layers and aim to prevent or limit data loss while enabling efficient recovery. Typical techniques leverage capabilities of solid-state drives (SSDs), block devices, storage firmware, hypervisors, or trusted hardware to detect malicious write patterns, isolate ransomware activity, and support rapid data restoration.

A substantial body of work explores embedding ransomware detection directly within storage devices, particularly SSDs, to detect malicious write patterns and enable rapid recovery. Min et al. [125] introduce Amoeba, an SSD architecture that incorporates a hardware accelerator to identify ransomware-infected pages and maintain fine-grained backup control to reduce storage overhead. Amoeba incurs negligible overhead and significantly outperforms the state-of-the-art SSD, FlashGuard, in both performance and space efficiency. Similarly, Baek et al. [126,127] propose SSD-Insider and its enhanced version SSD-Insider++, which leverage invariant behavioral features derived solely from block I/O headers to detect ransomware at the firmware level and exploit NAND flash’s delayed deletion property for instant, and lossless recovery. Paik et al. [128] further demonstrate that ransomware-induced access patterns can be detected through specialized buffer management policies within flash-based storage devices. While these SSD-integrated approaches benefit from low latency and independence from the host OS, they rely on modifications to storage firmware or architecture, which may limit portability across commodity hardware platforms.

Other works explore host-level and memory-storage coordination mechanisms to prevent encrypted data from being committed to persistent storage. Elkhail et al. [129] observe that encrypted data typically passes through the OS page cache before being written to disk and propose a runtime defense that intercepts this synchronization process to prevent malicious data from reaching permanent storage; Evaluated against over a thousand ransomware samples, including advanced variants using multi-threading and boot-sector attacks, the system reliably restores affected files while incurring minimal performance overhead. In contrast, Ma et al. [130] introduce RansomTag, a hypervisor-based framework that bridges semantic gaps between storage devices and higher-level system context using a tag-based interface. This design enables accurate detection and fine-grained version recovery of overwritten or deleted files while maintaining modest backup overhead. Compared with firmware-centric SSD solutions, these approaches provide greater deployment flexibility and richer contextual information, though they introduce additional complexity in memory management and virtualization layers.

Recent research also investigates cloud storage environments and hardware-level telemetry as alternative defense layers. Wang et al. [131] propose DeftPunk, a ransomware detection and recovery system designed for cloud block storage, combining a two-layer I/O classifier with snapshot-based recovery mechanisms to minimize data loss in multi-tenant environments. Hill et al. [132] demonstrate that ransomware activity can be detected through hardware performance counters collected from non-virtualized systems, showing that a small subset of hardware-level features can enable rapid detection with high accuracy. Zhu et al. [133] further extend storage-level defenses through their SrFTL system, which integrates semantic awareness into the flash translation layer of SSDs and leverages modified flash translation layer (FTL) with a trusted enclave to perform secure detection and recovery operations; evaluation shows SrFTL outperforms existing FTL-based solutions. Together, these approaches illustrate a shift toward cross-layer defenses that combine storage semantics, hardware telemetry, and trusted execution environments. However, their effectiveness often depends on specialized hardware support, system-level modifications, or close integration with storage infrastructure.

Open Issues: Storage- and hardware-level defenses often require modifications to firmware or system architecture, limiting deployability across heterogeneous environments. Many approaches assume write-heavy encryption behavior, which can be bypassed by ransomwares by selective or partial encryption strategies. Additionally, semantic gaps between OS, hypervisor, and storage layers hinder coordinated detection and response, particularly in multi-tenant cloud settings. These challenges correspond to C6 (deployment) and C7 (cross-layer integration).

Deception-based ransomware defenses adopt a “lure-and-contain” strategy, using decoy files, honeyfolders, or deceptive environments to trigger early detection and limit damage. Unlike ML or behavioral approaches that infer malicious intent, these methods rely on direct attacker interaction with crafted artifacts, providing highly interpretable signals but with limited coverage.

Early works (e.g., [134,135]) demonstrate that simple decoy files can effectively expose ransomware through abnormal access patterns or blocking behavior. These methods are lightweight and enable rapid containment, but their effectiveness depends heavily on decoy placement and assumes that ransomware will interact with them.

Subsequent approaches improve robustness through adaptive and multi-functional deception. Systems such as RTrap and Ranflood [136,137] extend decoy strategies with data-driven placement of decoy files, deliberately flooding targeted disk locations with decoy files to slow ransomware progress, moving target files, while other techniques exploit system features (e.g., alternate data streams) to mislead encryption targets. Compared to basic honeypots, these methods enhance coverage and mitigation capability, but introduce higher storage and management overhead.

More recent work moves toward active deception, where attackers are not only detected but actively disrupted. Frameworks such as ranDecepter [138], a real-time system that isolates ransomware in a deceptive environment and feeds the ransomware with counterfeit encryption data, increasing attacker cost and delaying impact. Compared to passive approaches, these systems improve resilience but require tighter system integration and careful configuration.

Overall, deception-based defenses exhibit a key trade-off: precision vs. coverage. They provide low false positives and interpretable detection signals, but rely on attacker interaction and can be bypassed by ransomware that detects or avoids decoys. Consequently, they are most effective as complementary mechanisms within a broader defense-in-depth strategy rather than standalone solutions.

Open Issues: Effectiveness depends on realistic decoy placement and configuration, which sophisticated ransomware can not evade. Large-scale deployment introduces management overhead, and limited integration with behavioral or learning-based systems reduces overall robustness. These challenges correspond to C2 (adversarial adaptation) and C6 (deployment constraints).

Reverse engineering and cryptographic analysis focus on understanding and breaking ransomware implementations to enable data recovery, rather than detecting attacks in real time. Compared to behavioral or ML-based methods, these approaches provide deeper insight into malware logic and encryption mechanisms, but are largely reactive and family-specific.

Empirical studies (e.g., [139]) show that many existing decryption tools fail in practice, highlighting a gap between claimed and actual recovery effectiveness. In contrast, targeted reverse engineering efforts (e.g., [140]) demonstrate that detailed analysis of specific ransomware families can yield effective decryption solutions, and present tools for reverse-engineering. This contrast underscores a key trade-off: broad applicability vs. practical effectiveness.

Another line of work exploits implementation flaws in ransomware cryptography (e.g., [141,142]). These studies show that even ransomware using strong cryptographic primitives can be broken if key-generation or randomness mechanisms are flawed. However, such success depends on the presence of subtle vulnerabilities, making these approaches opportunistic rather than generally applicable.

More recent work integrates reverse engineering with automated detection (e.g., [143]), by extracting features through reverse engineering for static analysis and converts executable binaries into images for deep learning-based classification to support scalable ML pipelines. Compared to pure decryption approaches, these methods improve scalability and generalization, but sacrifice the ability to directly recover data.

Overall, these approaches reveal a fundamental trade-off: depth vs. generalizability. Reverse engineering provides strong insight and potential recovery for specific families, but does not scale across evolving ransomware variants. Unlike detection-based methods, they operate post-compromise and depend heavily on implementation weaknesses, limiting their role to complementary forensic and recovery support.

Open Issues: Effectiveness is limited by strong cryptography and advanced obfuscation, while most solutions remain family-specific and difficult to generalize. Automated analysis lacks scalability against rapidly evolving ransomware. These challenges correspond to C10 (evolving threats) and C5 (scalability).

Recovery-focused approaches aim to restore data after compromise, primarily through entropy-based identification of encrypted files and protection of backup integrity. Unlike detection methods, these approaches are inherently reactive, emphasizing resilience rather than prevention.

Entropy-based techniques (e.g., [144,145]) identify encrypted files by detecting statistical randomness and support recovery by locating clean backup versions. While these methods are lightweight and effective for bulk encryption, their reliability depends on distinguishing encrypted data from compressed content and may degrade under selective or partial encryption. Thus, they trade simplicity and speed for reduced robustness.

In contrast, backup-integrity–focused approaches (e.g., [146]) target the protection of recovery mechanisms themselves by detecting attempts to delete or corrupt backup artifacts. Compared to entropy-based methods, they provide stronger resilience guarantees by preserving recovery points, but do not directly identify encrypted data or prevent initial damage.

Overall, these approaches highlight a key distinction: file-level recovery vs. infrastructure-level protection. Entropy-based methods facilitate restoration after encryption, while backup-integrity mechanisms ensure that recovery remains possible even under adversarial interference. However, both rely on a critical assumption that backups are intact and accessible, which is increasingly violated by modern ransomware employing backup targeting and data exfiltration.

Open Issues: Effectiveness of recovery is limited by compromised backups, false positives in entropy-based detection, and evasion via selective encryption. Additionally, poor integration with detection systems and lack of support for partial or semantic recovery reduce practical utility. These challenges correspond to C8 (recovery and resilience) and C7 (cross-layer coordination).

Ransomware response is not purely technical; it is shaped by economic incentives, human behavior, and policy constraints. Existing work can be broadly grouped into economic/strategic analyses, organizational and behavioral studies, and policy and governance frameworks, each offering complementary but incomplete perspectives.

Economic and strategic studies (e.g., [147–149]) highlight that ransom decisions are driven by cost-benefit trade-offs under uncertainty, where organizations weigh operational disruption, financial loss, and reputational impact. Game-theoretic models (e.g., [150,151]) further show that attacker-victim interactions are shaped by information asymmetry and strategic signaling, especially in double-extortion scenarios. While these approaches provide strong analytical insight, they often simplify real-world constraints and organizational complexity.

In contrast, organizational and behavioral studies (e.g., [152–154]) emphasize practical response challenges, including user susceptibility, communication failures, and incident coordination. These works show that effective defense requires socio-technical integration, combining technical controls with user awareness and response planning. However, their findings are often context-specific and less generalizable.

Policy and governance research (e.g., [155–158]) focuses on risk management, regulatory coordination, and cyber insurance. Compared to technical defenses, these approaches address systemic issues such as incentives and preparedness, but introduce trade-offs: for example, cyber insurance can improve resilience while potentially encouraging ransom payments.

Overall, the comparison reveals a central issue: analytical optimality vs. real-world practicality. Economic models provide decision frameworks, behavioral studies capture organizational realities, and policy approaches shape incentives, but none of these is useful as a stand alone approach. Effective ransomware response requires integrating these perspectives with technical defenses in a unified framework.

Open Issues: Decision-making remains highly uncertain, with limited guidance on ransom payment and negotiation. Misaligned incentives (e.g., insurance and payment dynamics) may encourage attackers, while Small and Medium Enterprises (SMEs) often lack resources for effective response. These challenges correspond to C9 (economic and policy factors).

Fig. 3 illustrates a cross-layer ransomware defense architecture in which telemetry from host, network, storage, and organizational layers is analyzed both locally and jointly. Behavioral analytics, ML/DL-based scoring, and deception- or storage-oriented mechanisms feed a central correlation engine that interacts with SIEM/EDR/NDR components and an automated response orchestrator. This design reflects a defense-in-depth philosophy: host-level monitoring supports early execution-stage detection, network-level analytics improve visibility into C&C and exfiltration, storage-level defenses help contain encryption damage, and recovery mechanisms provide resilience when prevention fails. The feedback loop is critical for long-term robustness, since ransomware tactics evolve rapidly and require continuous model updates, rule refinement, and policy adaptation.

On the other hand, Fig. 4 presents a cross-layer view of ransomware defense, integrating technical, economic, and human/policy dimensions into a unified response framework. At the top layer, technical defenses–such as advanced detection mechanisms, deception detection strategies, hardware-assisted protection, and backup/recovery systems–provide the core capability for identifying and mitigating attacks. However, these mechanisms alone are insufficient, as reflected in the middle layer, where economic constraints and human/policy factors shape real-world decision-making. Organizations must balance cost-benefit considerations, cyber insurance incentives, user awareness, and regulatory requirements, often under uncertainty, as highlighted by the central “decision dilemmas” (e.g., whether to pay or resist). The bottom layer emphasizes that effective ransomware defense ultimately depends on coordinated response, combining incident management, risk mitigation, and continuous adaptation across all layers. The key insight is that ransomware defense is not purely a technical problem but a socio-technical challenge, where robust protection emerges only through tight integration of detection technologies, economic incentives, and human-centered policies.

Ransomware can be viewed as an economic ecosystem driven by incentives, strategic interactions, and market structures. Existing work can be broadly grouped into economic analyses, game-theoretic models, ecosystem/market studies, and policy/governance perspectives, each capturing different facets of the ransomware economy.

Economic analyses (e.g., [159,160]) highlight that ransomware profitability is driven by weak organizational preparedness and the ability of attackers to optimize ransom pricing, including price discrimination across victims. These studies emphasize that ransomware persists because it is economically viable, but they often abstract away operational complexities.

Game-theoretic models (e.g., [161–163]) formalize attacker-victim interactions, showing how decisions on payment, prevention, and negotiation depend on incentives, information asymmetry, and expected losses. Compared to empirical studies, they provide analytical insights into optimal strategies, but rely on simplifying assumptions that may not capture real-world uncertainty and multi-stage attack dynamics.

Ecosystem-level studies (e.g., [164–167]) reveal that modern ransomware operates as a structured market, particularly through Ransomware-as-a-Service (RaaS) models, with affiliate-based operations, revenue sharing, and laundering mechanisms. These works provide realistic views of attacker operations, but are largely descriptive and less predictive.

Policy and governance research (e.g., [168–170]) addresses regulatory responses, attribution challenges, and the role of institutions. Compared to technical defenses, these approaches target systemic incentives, but face difficulties due to limited visibility, evolving attacker identities, and enforcement challenges.

Overall, the comparison highlights a key tension: analytical insight vs. real-world complexity. Economic and game-theoretic models explain incentives, ecosystem studies capture operational realities, and policy approaches shape responses, but none alone provides a complete solution. Effective mitigation requires aligning incentives across technical, organizational, and regulatory layers.

Open Issues: Existing models rely on simplified assumptions and limited empirical data, particularly for ransom payments and negotiation dynamics. The rise of RaaS further complicates incentive structures and attribution. These challenges correspond to C9 (economic factors).

This body of work provides cross-cutting perspectives on ransomware, including evolution analysis, taxonomies, datasets, and benchmarking frameworks. Unlike detection-specific studies, these efforts aim to structure the problem space, enable reproducibility, and provide broader contextual understanding.

Early studies (e.g., [171–175]) focus on the evolution of ransomware and its economic and technical drivers, highlighting why traditional defenses fail and emphasizing the need for specialized, proactive strategies. These works provide foundational insight but are largely descriptive and limited in methodological rigor.

Taxonomy-driven research (e.g., [176–178]) introduces structured models of ransomware behavior and attack lifecycles. Compared to early descriptive studies, these frameworks enable systematic analysis and mapping of defenses, but often remain static and may not fully capture rapidly evolving attack strategies.

A complementary line of work focuses on datasets and experimental platforms (e.g., [179–182]), providing benchmarks for evaluating detection methods. These contributions improve reproducibility and facilitate comparative evaluation, but their effectiveness is constrained by dataset realism and coverage of modern attack behaviors.

Other studies propose context-specific frameworks (e.g., [183–185]) tailored to particular environments such as enterprise systems or IoT, highlighting the need for domain-aware defenses. Finally, meta-analyses (e.g., [186,187]) reveal research trends, notably the dominance of detection-focused approaches and the relative lack of work on proactive and predictive defenses.

Overall, the comparison highlights a key progression: descriptive analyses → structured taxonomies → benchmark-driven evaluation. While these studies provide essential foundations and standardization, they remain limited by static models, outdated datasets, and insufficient alignment with evolving ransomware behaviors.

Open Issues: Existing datasets fail to capture the complexity of modern attacks, particularly regarding scale and diversity. Without standardized evaluation frameworks or longitudinal benchmarks, it remains difficult to ensure reproducibility or conduct fair performance comparisons across the field.

Recent research shows that ransomware is evolving beyond traditional file-encryption attacks toward multi-stage, cross-layer, and non-traditional threat models. The threat landscape encompasses hardware-level vulnerabilities, web-based infection vectors, and fileless execution techniques. Additionally, modern campaigns frequently combine encryption with data exfiltration and multi-layered extortion strategies.

Hardware- and storage-level studies (e.g., [188,189]) demonstrate that ransomware can operate below the OS layer, exploiting hardware trojans or SSD internals. Compared to software-based attacks, these approaches are more stealthy and harder to detect, but require specialized attacker capabilities, highlighting a trade-off between attack stealth and feasibility.

In contrast, web- and automation-based attacks (e.g., [190,191]) exploit modern browser APIs and automation frameworks to encrypt data without traditional malware installation. These methods significantly expand the attack surface, trading ease of deployment for reduced persistence and control.

Other works redefine ransomware threat models to account for fileless, human-operated, and exfiltration-driven attacks (e.g., [192,193]). Compared to earlier models that focus on encryption behavior, these frameworks emphasize multi-stage attack chains and cross-layer coordination, highlighting the limitations of detection systems built on outdated assumptions.

Finally, domain-specific studies (e.g., [194]) show that ransomware increasingly targets critical infrastructure, where attacks involve prolonged dwell time and complex system interactions. These environments require sector-specific defenses and forensic capabilities, rather than generic detection approaches.

Overall, the comparison reveals a fundamental shift: from single-stage encryption attacks to adaptive, cross-layer, and hybrid threat models. While new attack vectors improve stealth and impact, they also expose gaps in existing defenses, which remain largely focused on traditional behavioral or file-based indicators.

Open Issues: Modern ransomware combines exfiltration, fileless execution, and cross-layer techniques across cloud, browser, and hardware platforms. Existing defenses struggle to handle such hybrid, multi-stage attacks, highlighting the need for integrated and adaptive detection frameworks. These challenges correspond to C10 (emerging threat models) and C7 (cross-layer coordination).

Proactive defenses aim to prevent encryption before it occurs by disrupting ransomware’s ability to locate or access valuable data. Unlike detection-based methods, these approaches focus on attack surface manipulation rather than identifying malicious behavior.

File perturbation and moving-target strategies (e.g., [195–197]) randomize file extensions, hide file locations, or dynamically alter system visibility to confuse ransomware during reconnaissance and encryption phases. Compared to reactive defenses, these methods can reduce attack success without requiring detection, but rely on the assumption that ransomware uses predictable file discovery mechanisms.

Overall, these approaches highlight a key trade-off: prevention vs. usability. While they can significantly disrupt ransomware workflows, they may introduce compatibility issues and user overhead, and can be bypassed by adaptive malware performing deeper file-system inspection.

Open Issues: Effectiveness is limited by usability constraints and attacker adaptation. Real-world scalability remains underexplored, and integration with detection mechanisms is limited. These challenges correspond to C6 (deployment constraints).

Several studies examine the real-world operational and clinical consequences of ransomware attacks on healthcare organizations. Zhao et al. [198] present an early case study of a ransomware incident affecting a trauma center, demonstrating how disruptions to hospital information systems can significantly impair clinical workflows and delay patient care. Expanding this perspective, Neprash et al. [199] conduct a large-scale cohort analysis of 374 ransomware incidents affecting healthcare delivery organizations between 2016 and 2021. Their study reveals that ransomware attacks more than doubled during this period and exposed the personal health information of nearly 42 million patients, with increasingly large healthcare systems becoming primary targets. Complementing these findings, Dameff et al. [200] analyze the indirect operational consequences of a prolonged ransomware attack by examining patient flow data from two nearby emergency departments that were not directly targeted. Their analysis shows significant increases in patient volume, ambulance arrivals, wait times, emergency service diversion, and delays in critical treatments such as stroke care; These studies provide empirical evidence that ransomware attacks can cause widespread operational disruption within healthcare systems, affecting not only targeted facilities but also surrounding medical institutions and ultimately impacting patient safety and quality of care.

Open Issues: Empirical studies on ransomware impact in critical sectors remain limited, and the effects on operational continuity and patient outcomes are difficult to quantify. Inconsistent reporting and reliance on legacy infrastructure further complicate risk assessment and resilience planning. These limitations correspond to C1 (data gaps) and C6 (deployment challenges).

Table 9 summarizes prevention-, mitigation-, and recovery-focused ransomware research, along with their corresponding defense/recovery mechanisms and representative references. On the other hand, Table 10 provides a multi-dimensional view of ransomware research across three critical dimensions: threat models, defense layers, and adversarial capabilities.

This category includes diverse approaches that complement traditional detection and defense mechanisms, spanning forensic analysis, learning-based detection, and analytical modeling. These methods provide valuable auxiliary capabilities but are often specialized and less integrated into end-to-end defense frameworks.

Forensic and intelligence-driven approaches (e.g., [201,202]) focus on post-incident analysis, extracting artifacts such as ransom messages and identifying common attack patterns using frameworks like MITRE ATT&CK. Compared to real-time detection methods, these approaches enhance attribution and situational awareness but are inherently reactive and do not prevent attacks. In contrast, system-level and learning-based techniques (e.g., [203,204]) emphasize efficient runtime detection using advanced models or low-level instrumentation (e.g., eBPF). These methods achieve strong detection performance with low overhead, but their effectiveness depends on environment-specific assumptions and deployment constraints.

Other works explore alternative analytical models, including statistical methods, adversarially robust heuristics, and epidemiological modeling (e.g., [145,205,206]). While these approaches broaden the analytical perspective and improve robustness in specific scenarios, they remain limited in generalizability and integration with broader defense systems.

Open Issues: These approaches are often fragmented and rely on environment-specific assumptions, limiting scalability and generalization. Integration with threat intelligence, forensic pipelines, and standardized evaluation frameworks remains limited, highlighting challenges in C6 (integration) and C7 (cross-layer coordination).

Overall, the above subsection-specific limitations collectively map to the cross-cutting challenges (C1–C10), providing a unified view of open research directions across the ransomware defense landscape.

Compared to detection, ransomware recovery remains underexplored. Most existing approaches assume the availability of uncompromised backups, which is increasingly unrealistic as modern ransomware targets backup systems and incorporates data exfiltration.

Furthermore, recovery strategies often lack: (i) integration with detection systems, (ii) mechanisms for selective or partial recovery, (iii) consideration of data integrity and consistency, (iv) alignment with organizational response workflows. Future research should focus on adaptive recovery frameworks that combine secure backups, anomaly-aware restoration, and policy-driven response mechanisms.

Despite promising results, many ransomware defense techniques face significant barriers to real-world deployment. These include:

Performance overhead: Kernel-level monitoring and deep learning models introduce latency and resource consumption.

Scalability: Solutions often fail to scale across cloud-native, multi-tenant, or distributed environments.

Compatibility: Many approaches require modifications to OS, firmware, or applications, limiting adoption.

Operational integration: Limited integration with SOC workflows, SIEM systems, and incident response pipelines.

Privacy constraints: Monitoring approaches may conflict with regulatory requirements.

Addressing these challenges is essential for transitioning research prototypes into deployable solutions.

Ransomware detection systems are increasingly vulnerable to adversarial manipulation. Attackers can evade detection by mimicking benign behavior, injecting noise into feature space, or exploiting weaknesses in model training.

Existing work often lacks: (i) standardized adversarial evaluation benchmarks, (ii) robustness analysis across different attack models, (iii) defenses against poisoning and model extraction attacks.

Future systems must incorporate adversarial training, invariant feature design, and continuous adaptation to evolving threat strategies.

A major weakness in current ransomware research is the lack of standardized and realistic evaluation practices. Many studies rely on small, outdated, or highly curated datasets that do not reflect modern ransomware behaviors such as selective encryption, low-and-slow attacks, data exfiltration, fileless execution, and multi-stage extortion. As a result, reported performance is often difficult to compare across studies and may overestimate real-world effectiveness. This problem is compounded by inconsistent experimental settings, different feature extraction pipelines, and limited cross-dataset or longitudinal validation.

To address these issues, the community needs benchmark datasets that are continuously updated, diverse, and representative of multiple deployment contexts, including endpoints, cloud platforms, mobile devices, IoT/IIoT systems, and critical infrastructure. Such datasets should include benign workloads, realistic user behavior, recent ransomware families, and attack traces spanning pre-encryption, encryption, exfiltration, and recovery phases. Standard evaluation protocols are also needed to improve reproducibility and fairness. These should specify train/test dataset splits, temporal validation, cross-dataset testing, ablation studies, adversarial evaluation, and reporting of computational overhead and deployment assumptions.

Equally important is the use of metrics tailored to ransomware rather than relying solely on generic ML measures such as accuracy or F1-score. Since ransomware causes progressive harm over time, metrics such as time-to-detection, files protected before detection, damage prevented, recovery success rate, false alarm cost, and system overhead are often more informative than aggregate classification accuracy. Current evaluation practices are insufficient because they rarely capture operational impact, adversarial adaptation, or usability trade-offs, and they often ignore whether a method remains effective under realistic deployment constraints. Therefore, future work should move toward standardized, deployment-aware, and ransomware-specific evaluation frameworks that better reflect real-world defensive requirements.

Critical Insights and Lessons Learned: Research on ransomware prevention, mitigation, and recovery reveals several important insights that highlight both progress and persistent limitations in current defense strategies.

First, no single defense mechanism is sufficient. Effective ransomware protection requires a multi-layered and defense-in-depth approach that combines prevention (e.g., access control, patching), detection (behavioral or ML-based), mitigation (network isolation, process termination), and recovery (backup and restoration). Studies consistently show that isolated solutions fail against modern, multi-stage ransomware attacks. Second, many prevention mechanisms rely on assumptions that are increasingly invalid. Techniques such as signature-based detection or pre-encryption behavioral monitoring assume predictable attack patterns, yet modern ransomware employs stealthy execution, obfuscation, and delayed or selective encryption to evade such defenses. This highlights a fundamental gap between research assumptions and real-world adversarial behavior.

Third, mitigation strategies are often reactive and depend on timely detection. Approaches such as process termination, SDN-based traffic blocking, or access revocation can limit damage, but their effectiveness diminishes significantly if detection is delayed. As a result, mitigation alone cannot guarantee protection, particularly in fast-moving or low-and-slow attack scenarios. Fourth, recovery remains a critical yet underdeveloped component. While backup-based recovery is widely adopted, many studies assume that backups are intact and readily accessible. In practice, modern ransomware targets backup systems and incorporates data exfiltration, making recovery incomplete or insufficient for addressing extortion risks.

Fifth, there is a growing shift from prevention-centric to resilience-oriented security models. Traditional approaches prioritized preventing attacks entirely, but recent research emphasizes the importance of rapid recovery, system resilience, and operational continuity in the face of inevitable breaches. Finally, a key lesson is the need for cross-layer and adaptive defense frameworks. Current approaches are fragmented across host, network, storage, and organizational layers, whereas ransomware operates across all these layers simultaneously. Future solutions must integrate detection, mitigation, recovery, and policy-level responses into unified, adaptive, and adversarially robust systems.