Reliable Detection of Compressed and Encrypted Data

Abstract

Several cybersecurity domains, such as ransomware detection, forensics and data analysis, require methods to reliably identify encrypted data fragments. Typically, current approaches employ statistics derived from byte-level distribution, such as entropy estimation, to identify encrypted fragments. However, modern content types use compression techniques which alter data distribution pushing it closer to the uniform distribution. The result is that current approaches exhibit unreliable encryption detection performance when compressed data appears in the dataset. Furthermore, proposed approaches are typically evaluated over few data types and fragment sizes, making it hard to assess their practical applicability.This paper compares existing statistical tests on a large, standardized dataset and shows that current approaches consistently fail to distinguish encrypted and compressed data on both small and large fragment sizes. We address these shortcomings and design ENCOD, a learning-based classifier which can reliably distinguish compressed and encrypted data. We evaluate ENCOD on a dataset of 16 different file types and fragment sizes ranging from 512B to 8KB. Our results highlight that ENCOD outperforms current approaches by a wide margin, with accuracy ranging from ∼ 82% for 512B fragments up to ∼ 92% for 8KB data fragments. Moreover, ENCOD can pinpoint the exact format of a given data fragment, rather than performing only binary classification like previous approaches.

Evading behavioral classifiers: a comprehensive analysis on evading ransomware detection techniques

“…Mbol et al [45] use a test based on the Kullback-Liebler divergence to detect ransomware converting high-entropy JPEG files to encrypted content. Depending exclusively on randomness is dangerous [46,47] for reasons pointed out in Sect. 4.1.…”