Methods and systems for detecting a ransomware attack using entropy analysis and file update patterns

A processor implemented method for detecting a ransomware infection in a plurality of files received by a device operatively associated with a file synchronization and sharing network, each file including a plurality of sequential bytes of digital information, the method comprising:

• a) determining a value-count of byte values included in a file section associated with a received file, the value-count including a count of byte value occurrences of the byte values included in the file section;
• b) performing a low frequency analysis of the file section to determine if the file section is low frequency encrypted, the low frequency analysis including b1) calculating one or both of a low frequency entropy value associated with the file section and a low frequency average value of substantially all byte values associated with the file section, the low frequency entropy value associated with the count of byte value occurrences of the byte values included in the file section, and b2) comparing one or both of the calculated low frequency entropy value to a low frequency entropy threshold value and the calculated low frequency average value of substantially all byte values to a low frequency average value range threshold to determine if the received file is low frequency encrypted;
• c) performing a high frequency analysis of the file section to determine if the file section is high frequency encrypted, the high frequency analysis including c1) calculating one or both of a high frequency entropy value associated with the file section and a high frequency high-low probability ratio value associated with the file section, the high frequency entropy value associated with a plurality of subsection entropy values where each subsection entropy value is calculated for one of a plurality of consecutive subsections of bytes included in the file section, and the high frequency high-low probability ratio is calculated by dividing a high probability measure of a byte value by a low probability measure of a byte value included in the file section, and c2) comparing one or both of the calculated high frequency entropy value to a high frequency entropy threshold value and the calculated high frequency high-low probability ratio to a high frequency high-low probability threshold to determine if the received file is high frequency encrypted;
• d) if the file section is low frequency encrypted and high frequency encrypted, setting an encryption status condition associated with the received file to indicate the received file is encrypted;
• and
• e) if the received file encryption status condition indicates the received file is encrypted, utilizing a watcher to monitor file events associated with the plurality of files received by the device associated with the file synchronization and sharing network to determine if one or more of the plurality of files are ransomware infected.