# Ransomware Detection and Classification Strategies

arXiv: https://arxiv.org/abs/2304.04398 · HTML: https://mlsanity.com/paper/2304.04398/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Apr 2023.

## Built on by (most cited first, 1 of 1)

- [Ransomware Detection and Classification using Machine Learning](https://mlsanity.com/paper/2311.16143/) (2023)

## Abstract (arXiv)

Ransomware uses encryption methods to make data inaccessible to legitimate users. To date a wide range of ransomware families have been developed and deployed, causing immense damage to governments, corporations, and private users. As these cyberthreats multiply, researchers have proposed a range of ransomware detection and classification schemes. Most of these methods use advanced machine learning techniques to process and analyze real-world ransomware binaries and action sequences. Hence this paper presents a survey of this critical space and classifies existing solutions into several categories, i.e., including network-based, host-based, forensic characterization, and authorship attribution. Key facilities and tools for ransomware analysis are also presented along with open challenges.