What is entropy detection?
Entropy detection is a technique for spotting ransomware by measuring the randomness of data. Encrypted data is statistically close to random, so a sudden rise in the randomness of files or backup blocks suggests that something has been encrypting them.
What is entropy in this context?
Entropy is a measure of unpredictability in a sequence of bytes. Text, databases and most documents contain patterns and repetition, which gives them low to moderate entropy. Compressed and encrypted data has had its patterns removed and scores near the maximum. A file server whose documents change from moderate to near-maximum entropy overnight has very probably been encrypted.
How is entropy detection used with backups?
Backup software sees every changed block each night, which makes it a convenient place to watch for encryption. Three signals are commonly combined.
| Signal | What it indicates |
|---|---|
| Rise in entropy of changed blocks | Data is being replaced by encrypted content |
| Unusually large incremental | Far more data changed than on a normal day |
| Drop in compression or deduplication ratio | New data no longer reduces, as encrypted data does not |
| Mass file renames or new extensions | Typical of file-encrypting ransomware |
| Ransom notes or known file names | Direct indicator found by content inspection |
What are the limits of entropy detection?
Entropy alone cannot tell malicious encryption from legitimate high-entropy data. Compressed archives, images, video and files encrypted on purpose all look the same. A system that starts storing such data triggers an alert without any attack. Some ransomware also encrypts only part of each file, or works slowly, specifically to stay under thresholds. Entropy detection is therefore a prompt to investigate and is strongest when several signals agree. It also reports encryption that has already happened, which makes it a detection control and not a preventive one.
How does it help recovery?
The value for recovery is timing. A record of when entropy first rose on each system points to the last restore point taken before encryption began, which narrows the search for a clean restore point. Combined with malware scanning of backups and the findings of the incident investigation, it helps decide what to restore from. The detection record needs to be stored where an attacker cannot erase it, and the restore points it refers to need to be immutable.
Frequently asked questions
Does high entropy always mean ransomware?
No. Compressed, encrypted and media files are high in entropy by nature. The meaningful signal is an unexpected change.
Can storage detect entropy in encrypted backups?
Not usefully. If the backup software encrypts data before writing it, everything the storage receives looks random. Detection has to happen before that encryption.
Does entropy detection stop an attack?
It raises an alert. Stopping the attack depends on the response that follows.