Аңдатпа
Ransomware detectors and forensic tools often treat a file or disk block as encrypted when its Shannon entropy approaches 8 bits per byte. Compressed formats reach almost the same entropy, which causes false alarms, and partial encryption or text encoding of the ciphertext can lower entropy below common thresholds. This study measures how far byte-level statistics separate encrypted from compressed data and how the answer depends on fragment size. A corpus of 595 files in 17 formats, including Deflate, bzip2 and LZMA compressed archives, documents and images, was built from the Govdocs1 collection and encrypted with AES-256 or ChaCha20; evasion variants used intermittent encryption, Base64 encoding and encryption of the first megabyte. Fragments of 512 bytes, 4 kilobytes and 64 kilobytes were described by entropy, the chi-square statistic and four further byte statistics, and threshold rules, logistic regression and random forest were evaluated with cross-validation grouped by file. Entropy and chi-square ranked fragments almost identically, as expected from their known asymptotic equivalence, so chi-square did not separate the classes better; its advantage was a size-independent threshold. A fixed entropy threshold of 7.9 bits per byte missed every encrypted 512-byte fragment and flagged 73% of unencrypted 64-kilobyte fragments. Deflate-based formats became separable only with large fragments, whereas xz and 7z archives remained close to chance for every method. Base64 encoding removed detection completely, and intermittent encryption was rarely detected in large fragments of uncompressed files. Byte statistics can therefore show that data are not plaintext but cannot confirm that compressed data are encrypted; detectors need size-aware thresholds, decoding of text encodings and format validation.