Ransomware and artificial intelligence: a comprehensive systematic review of reviews

Abstract

This study provides a comprehensive synthesis of artificial intelligence (AI), especially machine learning (ML) and deep learning (DL) in ransomware defense. Using a “review of reviews” methodology based on the PRISMA, this paper gathers insights on how AI is transforming ransomware detection, prevention, and mitigation strategies in the past five years (2020-2024). The findings highlight the effectiveness of hybrid models, which combine multiple analysis techniques such as code inspection (static analysis) and behavior monitoring during execution (dynamic analysis). The study also explores anomaly detection and early warning mechanisms before encryption that tackle ransomware’s growing complexity. It also examines key challenges in ransomware defense, such as techniques designed to deceive AI driven detection, and the lack of strong and diverse datasets. It highlights AI’s role in early detection and real-time response systems, enhancing scalability and resilience. With the systematic review of reviews approach, the contributions of this study are systematically consolidating research insights from multiple review articles, identifying effective AI models, and bridging theory with practice to foster collaboration among academia, industry, and policymakers. Future research directions are anticipated and practical recommendations for cybersecurity practitioners are provided. Finally, it presents a roadmap for advancing AI-driven countermeasures, for the protection of key systems and infrastructures against evolving ransomware threats.