Intermittent File Encryption in Ransomware: Measurement, Modeling, and Detection

TL;DR

Ransomware increasingly uses intermittent encryption to defeat content‑based detection, prompting a measurement, modelling, and detection study of byte‑level file signatures. The authors characterize how byte histograms evolve across 11 file types as encryption coverage $\alpha$ grows, and derive a file‑type specific KL‑based bound with a simple ceiling $\tau_F(\alpha)$ governing detectability via a convex mixture with a uniform ciphertext reference. They operationalize these insights into a detection pipeline that emphasizes locality: encoding 10 KB byte histograms as 16×16 images and running a chunk‑level ConvNeXt classifier, with per‑file type thresholds; this approach achieves about $97\%$ accuracy across modes and file types, outperforming whole‑file baselines. GAN augmentation yields limited gains, underscoring that the critical signal lies in localized evidence rather than synthetic diversity. The work provides a principled, file‑type aware baseline that supports practical ransomware defense, incident response triage, and retrospective scans of endpoints and backups, while guiding future improvements in multi‑scale chunking and ensemble strategies.

Abstract

File encrypting ransomware increasingly employs intermittent encryption techniques, encrypting only parts of files to evade classical detection methods. These strategies, exemplified by ransomware families like BlackCat, complicate file structure based detection techniques due to diverse file formats exhibiting varying traits under partial encryption. This paper provides a systematic empirical characterization of byte level statistics under intermittent encryption across common file types, establishing a comprehensive baseline of how partial encryption impacts data structure. We specialize a classical KL divergence upper bound on a tailored mixture model of intermittent encryption, yielding filetype specific detectability ceilings for histogram-based detectors. Leveraging insights from this analysis, we empirically evaluate convolutional neural network (CNN) based detection methods using realistic intermittent encryption configurations derived from leading ransomware variants. Our findings demonstrate that localized analysis via chunk level CNNs consistently outperforms global analysis methods, highlighting their practical effectiveness and establishing a robust baseline for future detection systems.

Figures (8)

• Figure 1: Evolution of statistical traits of two representative file families (xls which is uncompressed/binary, and mp4 which is lossy) with increasing amounts of encryption. The two inner bands around each curve represent the first and third quartiles, while the external bands represent the tenth and ninetieth percentiles.
• Figure 2: Per-family escape ceilings under intermittent encryption. Theoretical KL ceiling $\tau_F(\alpha)=\tfrac{256}{\ln 2}\,c_F^{2}(1-\alpha)^2$ for XLS (blue) and MP4 (red); dashed line marks detector threshold $\tau=0.01$.
• Figure 3: Illustration of the encoding scheme used to map each file to a greyscale image: a $16{\times}16$ array of max-normalized byte-histogram bins (0x00 at top-left, 0xFF at bottom-right). Panels show the same file at 0%, 25%, 75%, and 100% encryption.
• Figure 4: Classification accuracy for three detector-training strategies: (a) a baseline model trained only on fully encrypted and unencrypted files; (b) model additionally trained on real intermittently encrypted samples; and (c) baseline further augmented with GAN-synthesised intermittently encrypted examples.
• Figure 5: Comparison of real vs GAN-generated BMP images

Theorems & Definitions (2)

• Proposition 1: Family–specific unattainable threshold
• proof