A systematic literature review on ransomware detection by evidence-based software engineering method

Ransomware attacks, which aim to take ransom by encrypting the files they infect with unbreakable passwords, have become an increasing threat in recent years. Decrypting encrypted files without data loss is nearly impossible without the encryption key. This often obliges ransomware victims to pay the amount of the ransom demanded. The purpose of our study is to present a systematic literature review of ransomware detection research. The method we base on while performing a systematic literature review is the Evidence-Based Software engineering approach. This approach is based on the Evidence-Based Medicine method, which has been successfully applied in many fields. Six steps of Evidence-Based Software Engineering have been implemented in sequence. For this purpose, 114 scientific articles, which fall within the scope of our research questions, were researched from the studies conducted between 2017 and 2022 on ransomware detection. According to our quality evaluation rules, 49 articles meeting our quality criteria were analyzed. The answers to our research questions, which we determined through the analyzed articles, are presented in detail.