## 4 Analysis
### Interpreting Entropy Variations  
Since baseline information entropy values are generally consistent across a range of deployment contexts, a deviation in entropy may be useful to indicate the type of content being transferred, and whether this is normal or anomalous behaviour. For example, if a user is uploading an encrypted file using FTP, we would anticipate a higher entropy value than the expected baseline (around 4.1) for a particular flow. If this transfer were to be an unknown external destination, then this might raise suspicion about the possibility of  
Figure 7: Illustrates the effects of symbolic content on entropy values using four raw text files. The three special ‘symbol_test’ files have limited symbolic alphabets. symbol_test_mono comprises only 1 repeated symbol, with a corresponding entropy close to zero. symbol_test_duo contains two repeated symbols, with a corresponding entropy close to 1. symbol_test_full contains a richer alphabet of 96 symbols (A–Z, a–z, plus punctuation, etc.), with corresponding entropy rising above 6. The final example is a text representation of a book, which has a lower entropy than symbol_test_full because of the frequent symbol repetitions typical in written language (some letters and sequences are far more common than others). Encrypted versions of these files also exhibit wide entropy variations in lower values due to the lack of symbol variety in the source data.  
data exfiltration. Here again, some domain expertise can be valuable, coupled with local knowledge on user behaviour and the type of data being moved (for example, moving encrypted data over a plaintext channel such as FTP to a third party could be suspicious).  
Embedded malware and executable files, often compressed, may also be an indicator of unusual content. For reference, several common types of file content have been analysed and their respected entropy values given in Figure 8, together with their post-encrypted entropies. Note that compressed content (here, we tested ZIP compression, although other comparable compression methods will present similar entropy results. The more efficient the compression method, the higher the entropy) exhibits entropy close to eight, as we might expect, due to symbol repetition compaction. In these tests, AES encryption was used with 256 byte keys, although other key sizes yielded similar entropy results. Domain expertise may be useful in determining whether a flow with very high entropy is likely to be encrypted or compressed--for example, by examining a flow to establish whether entropy is consistent throughout its lifespan.  
To illustrate the relationship between entropy and symbolic variety more clearly, Figure 7 illustrates entropy values for three test files, plus an example of a well-known English text. The test files were constructed with increasing levels of symbolic variety,  
Figure 8: Common file types and entropy values. ‘Plaintext’ here means unencrypted. On the right, we also see corresponding entropies for AES 256 encrypted files. We use just the 256 block size as an illustrative, since a larger block size does not significantly improve the results, given these are close to 8.0 already. Note that zip compressed files and encrypted files tend to have entropies close to 8.  
and we can clearly see corresponding changes in entropy. From this, and the examples in Figure 7, we can reasonably infer that typical written messages and content would be expected to have entropy in the mid-range (between three and five).