  The threat from ransomware continues to grow both in the number of affected
victims as well as the cost incurred by the people and organisations impacted
in a successful attack. In the majority of cases, once a victim has been
attacked there remain only two courses of action open to them; either pay the
ransom or lose their data. One common behaviour shared between all crypto
ransomware strains is that at some point during their execution they will
attempt to encrypt the users' files. Previous research Penrose et al. (2013);
Zhao et al. (2011) has highlighted the difficulty in differentiating between
compressed and encrypted files using Shannon entropy as both file types exhibit
similar values. One of the experiments described in this paper shows a unique
characteristic for the Shannon entropy of encrypted file header fragments. This
characteristic was used to differentiate between encrypted files and other high
entropy files such as archives. This discovery was leveraged in the development
of a file classification model that used the differential area between the
entropy curve of a file under analysis and one generated from random data. When
comparing the entropy plot values of a file under analysis against one
generated by a file containing purely random numbers, the greater the
correlation of the plots is, the higher the confidence that the file under
analysis contains encrypted data.
