Deterrence against Zero Day Ransomware Strike A Comparative Analysis

A moderate risk for both individuals and organizations in the realm of network security and cybersecurity is Ransomware. Ransomware is a type of sophisticated malware that targets not only Windows-based operating systems but also Linux and Android. It does this by taking advantage of flaws in the various versions of these operating systems or device driver software to get access to a machine. Once inside, ransomware encrypts user files using strong cryptographic methods, making the data inaccessible and, in many cases, impossible to recover without proper backups. To bypass early security checks, ransomware often disguises itself as a legitimate file before execution. After the malicious payload is activated, reversing the encryption process becomes extremely difficult for known ransomware variants and nearly impossible when a previously unknown variant, commonly referred to as a zero-day attack, is involved. The objective of this paper is to provide a clear understanding of the challenges posed by ransomware and to examine existing mitigation techniques through the analysis of 25 relevant research studies. Several effective prevention strategies are discussed, including secure execution mechanisms, early detection of encryption activity, user-level authorization for file modifications, and Host Intrusion Prevention System (HIPS)–based controls. These approaches can significantly restrict ransomware execution and, in some cases, stop the attack entirely. Since unauthorized file encryption and modification form the core objective of ransomware, preventing these actions directly limits the attacker’s success. Therefore, implementing appropriate security measures before an attack occurs is essential for reducing ransomware impact.