Identificación de modelos de aprendizaje automático para la detección de ransomware en empresas basado en bibliografía

Abstract

A detailed study of the machine learning models used in the identification of ransomware in corporate environments is carried out, based on an extensive literature review. The research analyzes the progress from conventional signature-based techniques to more advanced solutions using artificial intelligence. Several algorithms are recognized and evaluated, with Random Forest (RF) and Extreme Gradient Boosting (XGB) standing out, which have shown detection rates exceeding 97% in threat detection. The study pursues three specific goals: the analysis of previous research on ML methods, the consolidation of findings on the benefits and constraints of each method, and the comparison of strategies on various technology platforms. The findings indicate that hybrid methods, which merge static and dynamic analysis, are particularly effective in identifying unknown ransomware variants. The experimental study conducted presents confusion matrices and accuracy assessments that show significant challenges, such as imbalance in the data sets and the requirement to improve detection in the minority category (ransomware). Critical areas for improvement are recognized, including scalability of solutions in corporate infrastructures and adaptation to resource-scarce environments such as IoT. The findings highlight the need for an integrated approach that combines ML models with regulatory frameworks such as the NIST CSF, noting the importance of developing adaptive solutions that can respond to the increasing sophistication of attacks that incorporate offensive artificial intelligence techniques.