Shannon Entropy Analysis

Every file is measured for its information density using Shannon entropy (0–8 bits per byte). Normal email content scores 4.0–5.5. Compressed files reach 6.0–7.0. Ransomware-encrypted data hits 7.8–8.0 — virtually indistinguishable from random noise.

This works because encryption algorithms (AES, RSA, ChaCha20) produce pseudo-random output that maximizes entropy — a mathematical fingerprint that can’t be hidden.

Compression Ratio Analysis

Random data cannot be compressed — this is a fundamental law of information theory. Normal email content compresses 40–70% with modern algorithms. Ransomware-encrypted content compresses less than 5%.

This detection is algorithm-agnostic. Whether we use Zstandard, gzip, or any other compressor — encrypted data will always fail to compress. A sudden drop in compression ratio across a backup run is a strong indicator of ransomware activity.

Statistical Anomaly Detection

Every backup run is compared against a 30-day rolling baseline of the mailbox's normal behavior. Mass deletions, mass updates and volume spikes are scored with robust statistics that outliers cannot skew.

• Mass-delete & mass-update detection: flags unusual change volume per mailbox
• Robust per-mailbox baselines: median-based statistics that single outliers can't distort
• Restore-aware: recent restores are recognized so recovery never triggers false alarms
• Proportional severity bands MEDIUM / HIGH / CRITICAL — anomalous runs are excluded from future baselines

Entropy Uniformity Check

A normal mailbox contains diverse content: plain text emails (entropy ~4.0), HTML newsletters (~5.5), PDF attachments (~6.5), and images (~7.0). This creates natural variation in entropy values.

Ransomware eliminates this variation. When all files show uniformly high entropy (average > 7.0, standard deviation < 0.1), it means every file has been encrypted with the same algorithm — a clear sign of ransomware, even if individual entropy values alone wouldn’t trigger an alert.

Ransomware IOC Matching

Attachment and file names are matched against a curated feed of known ransomware indicators: 100+ file extensions used by families like LockBit, Akira or BlackCat, plus ransom-note filename patterns.

An IOC hit is the highest-precision signal there is — a ransom note inside a backup is virtually never legitimate. Matches escalate the run immediately and corroborate the statistical findings.

Multi-Signal Corroboration

Drastic action requires agreement. Snapshots are frozen only on a critical finding, or when at least two independent signal families point the same way. A single noisy metric never locks up your data.

Detection also correlates across mailboxes: if several mailboxes of a tenant turn anomalous within the same hour, Backup Shield raises a tenant-wide critical alert — the signature of a real ransomware event or a compromised account.