Generative AI for Ransomware Identification and Mitigation: Taxonomy, Challenges, and Future Directions

Abstract

Ransomware is a relevant threat that is causing losses in millions and affecting several organizations worldwide. Emerging actors leverage strategies such as living-off-the-land, obfuscation, and fileless malware to perform increasingly sophisticated attacks. Generative AI is now being considered as a tool for combating cyberattacks, but its real-world effectiveness, risks, and deployment trade-offs are still unclear in the field of ransomware, pointing to the need for a thorough, rigorous review. This review paper investigates the application of generative AI techniques for the detection and mitigation of ransomware attacks. To this end, we introduce a taxonomy for categorizing the solutions presented in recent studies, thereby offering deeper insights, detecting challenges, and proposing research directions. We also discuss misalignment between academia and industry solutions given the current ransomware landscape. This research presents a first analysis of transformer models and generative adversarial networks leveraged exclusively to detect and mitigate ransomware. Our review reveals that there is a need for dedicated and up-to-date ransomware datasets, new detection strategies, and new data for static and dynamic analysis.