Abstract Ransomware has become one of the most destructive cyberattacks worldwide in recent years and has caused billions of dollars. Numerous defense mechanisms have been proposed to mitigate the ransomware threat. However, as attack technologies advance, ransomware has rapidly evolved. It employs sophisticated techniques to evade traditional defense mechanisms and has lead to devastating impacts on organizations globally. While many studies have focused on ransomware and its defense, none have provided a comprehensive overview of the ongoing battle between defense mechanisms and the evolving ransomware. They also do not explore the techniques employed by ransomware authors to evade detection. To fill this gap and motivate further research, we conduct an extensive investigation into evasive ransomware, including the common techniques they employ and the efforts researchers have made to counter them. Based on this, we offer a preliminary exploration of potential defense concepts that track multi-level events across different attack stages and leverage the correlations between them to construct the attack flow. This paper helps researchers in the ransomware field gain a comprehensive understanding of evasive ransomware. It also offers insights for future researchers to enhance defense mechanisms to cover the potential threats identified in this study, minimizing the losses caused by evasive ransomware.

Ransomware attacks pose significant threats and have caused substantial economic losses across various industries worldwide. Existing defense mechanisms typically focus on detecting ransomware in environments free from interference by other legitimate programs. However, in real-world applications, ransomware often coexists with normal programs, resulting in fragmented behavioral patterns that reduce detection accuracy. To address this issue, we propose a system-level ransomware detection approach, named RanDoctor. This method leverages long-time series analysis to capture the behavioral characteristics of ransomware, thereby improving the comprehensiveness and accuracy of detection. To further enhance system performance, we design the Ranformer model, incorporating the ProbSparse self-attention mechanism and a distillation process. Experimental results demonstrate that the RanDoctor system achieves a detection accuracy of 99.5%, representing a 8.0% improvement over state-of-the-art detection models.