A Review of Ransomware Detection and Analysis Techniques

Ransomware has turned from an opportunistic nuisance into one of the most costly classes of cyber-attack, and the research effort aimed at detecting it has grown accordingly. This paper reviews that effort. Drawing on 90 unique studies published between 2013 and 2027, most of them after 2021, we organise the literature around five detection families: static file analysis, dynamic and host-telemetry analysis, deception and low-level sensing, network-based detection, and family attribution, with machine learning treated as a layer that cuts across all of them. For each family we summarise the features that are extracted, the models that are trained on them, the results that are reported and, just as importantly, the conditions under which those results were obtained. Three findings stand out. First, no single modality is sufficient: static PE-header features remain cheap and surprisingly strong for triage, but short-window behavioural telemetry is what makes interruption before bulk encryption possible, and network signals add a useful, largely independent early warning. Second, well-engineered features matter more than model depth; Random Forest and SVM remain competitive with deep networks in many settings. Third, headline accuracies above 95% coexist with fragile generalisation under packing, delayed encryption, altered I/O ordering and fileless execution, and heterogeneous datasets and protocols make cross-paper ranking unreliable. We close with a qualitative comparison of the modalities, a layered reference architecture built around disagreement-aware fusion, and a research agenda that emphasises aligned multi-modal benchmarks, family-disjoint and time-split evaluation, and deployment-level reporting.