Few-Shot Learning for Ransomware Detection: A Narrative Review of Machine Learning, Deep Learning and Siamese Neural Network Approaches

The review examines static and dynamic analysis, binary-image representation, entropy features, transfer learning, Siamese architecture, and commonly used evaluation metrics. Findings from the reviewed studies suggest that few short learning (FSL) and Siamese neural network (SNN) based approaches may offer potential benefits for ransomware detection when labeled data are limited. However, variations in datasets, experimental configurations, few-shot settings, and evaluation procedures prevent definitive conclusions about their comparative superiority. This paper synthesizes existing research and does not present new experiments or independent experimental validation. The review identifies several research priorities, including clearly defined N-way/K-shot settings, diverse datasets, evaluation on unseen ransomware families, standardized evaluation procedures, and practical real-time assessment. Addressing these challenges may support the development of more reliable and data-efficient ransomware detection methods.