A Systematic Survey of Ransomware Detection Through Pipelines: From Runtime Telemetry to Explainable and Response-Aware Defense

Abstract

Ransomware has evolved from simple file encryption into an advanced cyberattack that includes stealthy intrusion, behavioral manipulation, lateral movement, data exfiltration, and encryption-based impact. Much research has focused on ransomware detection. However, previous methods are fragmented and focus on detecting a single aspect, such as static analyzers, API-call modelling, deep learning, pre-encryption detection, explainable artificial intelligence (XAI), or response inference. However, many solutions achieve high detection accuracy in controlled environments. However, they are not adaptable in real time, lack context awareness, are not explainable, or have no integrated response functions. Recent research suggests that most available detection methods rely on a single telemetry source, such as API sequences, DLL usage, mutex behavior, or sandbox logs, and that ransomware detection is more of a classification problem than a continuous behavioral reasoning process. The limited interpretability of AI models has led to the use of XAI techniques to enhance transparency and trust while maintaining high detection performance. At the same time, Work has been conducted on early detection, cyber threat intelligence (CTI), ontology-based reasoning, and adversary behavior modelling. This survey presents a systematic review and classification of ransomware detection research, focusing on four key areas: telemetry collection, feature engineering for ransomware behaviors, machine learning and deep learning, and intelligent response mechanisms, each of which is broken down into subcategories. This survey describes and combines results from the following research approaches: dynamic API Modelling, CTI-enhanced analysis, early detection strategies, and MITRE ATT&CK-based behavioural modelling, to present a full picture of intelligent, explainable, and response-aware ransomware defence systems and highlight issues and future research directions.