The increasing sophistication of malware threats has led to growing concerns in the anti-malware community, as malware poses a significant danger to online users despite the availability of numerous defense solutions. The aim of this study is to comprehensively review malware evolution and current attack trends in order to identify effective defense mechanisms. This study reviewed the most recent journal articles, conference proceedings, reports, and online resources published over the last five years. We extensively reviewed the malware landscape from 1970 to the present, and analyzed its types, operational mechanisms, attack vectors, and vulnerabilities. Furthermore, we explored different defensive strategies developed in response to these evolving threats. Our findings highlight the increasing sophistication of malware attack trends, including a surge in cryptojacking, attacks on mobile devices, Internet of Things devices, ransomware, advanced persistent threats, supply chain attacks, fileless malware, cloud-based attacks, exploitation of remote employees, and attack trends on edge networks. Defense strategies have also evolved in parallel, emphasizing multi-layered security measures to counter these dynamic threats. This study highlights the critical need for robust, multi-layered security measures to combat dynamic malware. Despite these advancements, some open challenges and significant research gaps remain, which require further innovation. This review serves as a valuable guide for cybersecurity professionals by identifying the key trends, challenges, limitations, and future research on cybersecurity.

Ransomware attacks are becoming increasingly sophisticated, thereby rendering conventional detection methods less effective. Recognizing this challenge, this study reviews advanced detection mechanisms and explores the potential of artificial intelligence (AI) techniques to improve detection capabilities. This study reviews the recent literature, including journal articles, conference proceedings, and online resources since 2017, to offer insights into the current state of AI-based ransomware detection and suggests future research directions. This study contributes significantly to the development of a systematic evaluation framework that evaluates each component of the AI-based detection model framework using specific criteria and methodologies and analyzes how various AI algorithms respond to different ransomware attacks, thereby providing insights for more effective and robust detection methods. This review begins with an overview of AI and ransomware, and discusses various types of ransomware attacks, the process of an attack chain, and emerging trends. We then review the existing literature on the core components of AI-based ransomware detection models, including the datasets and challenges arising during data collection, data pre-processing, feature engineering techniques, model training, and performance evaluation for effective model training. This study assessed the detection performance of AI models using metrics such as accuracy, precision, recall, and F1-score. By synthesizing these findings, we identify gaps in the current research and suggest future directions for enhancing AI-based ransomware detection techniques. The insights provided aim to guide researchers and practitioners in developing more robust methods for detecting and mitigating ransomware attacks by using AI.

Malware has emerged as a significant threat to end-users, businesses, and governments, resulting in financial losses of billions of dollars. Cybercriminals have found malware to be a lucrative business because of its evolving capabilities and ability to target diverse platforms such as PCs, mobile devices, IoT, and cloud platforms. While previous studies have explored single platform-based malware detection, no existing research has comprehensively reviewed malware detection across diverse platforms using machine learning (ML) techniques. With the rise of malware on PC or laptop devices, mobile devices and IoT systems are now being targeted, posing a significant threat to cloud environments. Therefore, a platform-based understanding of malware detection and defense mechanisms is essential for countering this evolving threat. To fill this gap and motivate further research, we present an extensive review of malware detection using ML techniques with respect to PCs, mobile devices, IoT, and cloud platforms. This paper begins with an overview of malware, including its definition, prominent types, analysis, and features. It presents a comprehensive review of machine learning-based malware detection from the recent literature, including journal articles, conference proceedings, and online resources published since 2017. This study also offers insights into the current challenges and outlines future directions for developing adaptable cross-platform malware detection techniques. This study is crucial for understanding the evolving threat landscape and for developing robust detection strategies.

The increasing frequency of ransomware attacks necessitates the development of more effective detection methods. Existing image-based ransomware detection approaches have largely focused on static analysis, overlooking specialized ransomware behaviors such as encryption, privilege escalation, and system recovery disruption. Although dynamic and memory forensics-based visualization methods exist in the broader malware domain, they primarily target generic malware families and often rely on memory dumps or system snapshots without transforming behavioral features into spatially meaningful representations. Moreover, traditional machine learning methods such as Random Forest (RF), Support Vector Machine (SVM), and K-Nearest Neighbors (KNN) typically depend on manual feature engineering and large labelled datasets, limiting scalability and adaptability. To address these limitations, we propose a novel behavior-to-image ransomware detection framework that transforms dynamic behavioral features extracted from sandbox-generated JSON reports into two-dimensional (2D) grayscale and color image representations, optimized for transfer learning (TL), enabling effective classification under small-data conditions. Our approach integrates domain-specific feature filtering and impact analysis to ensure the selection of the most ransomware-relevant attributes. TL subsequently automates feature extraction and classification, eliminating the need for separate feature selection procedures and overcoming the time-consuming process of manual feature engineering. Furthermore, by leveraging prior knowledge from large-scale image datasets, TL significantly mitigates the need for extensive labelled data while maintaining high detection accuracy and strong generalization. Experimental results demonstrate that fine-tuned pretrained models, notably ResNet50, achieve up to 99.96% accuracy with a minimal loss factor of 0.0026, even with a small dataset of 500 ransomware and 500 benign samples. We further validated the model’s interpretability through t-SNE visualizations and saliency maps, confirming its ability to focus on class-discriminative behavioral patterns. The low misclassification rate, along with the transparency of the model, highlights its potential for practical deployment in ransomware detection systems.

Malware has emerged as a significant threat to end-users, businesses, and governments, resulting in financial losses of billions of dollars. Cybercriminals have found malware to be a lucrative business because of its evolving capabilities and ability to target diverse platforms such as PCs, mobile devices, IoT, and cloud platforms. While previous studies have explored single platform-based malware detection, no existing research has comprehensively reviewed malware detection across diverse platforms using machine learning (ML) tactics. With the rise of malware on PC/laptop devices, it is now targeting mobile devices and IoT systems, posing a significant threat to cloud environments. Therefore, a platform-based understanding of malware detection and defense mechanisms is essential for countering this evolving threat. To fill this gap and motivate further research, we present an extensive review of malware detection using ML techniques with respect to PCs, mobile devices, IoT, and cloud platforms. This paper begins with an overview of malware, including its definition, prominent types, impacts, analysis, and features. It presents a comprehensive review of machine learning-based malware detection from recent literature, including journal articles, conference proceedings, and online resources published since 2017. This survey also offers insights into current challenges and outlines future directions for developing adaptable cross-platform malware detection techniques. This survey is crucial for understanding the evolving threat landscape and developing robust detection strategies.