A server manager for detecting ransomware, comprising: a server interface configured to: retrieve, from a storage device, a backup stored by a client device; and transmit information describing whether the backup includes the ransomware for display on the client device; and a ransomware detection module communicatively coupled to the server interface and comprising: a statistical filter configured to: generate a standard pattern of file activities of the client device for a time period; and perform a statistical behavior analysis on the backup based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern, the statistical anomaly corresponding to an abnormal file activity, the portion of the backup comprising a plurality of files and the statistical behavior analysis comprising determining a ratio of a number of file activities associated with the portion of the backup to a total number of the plurality of files in the portion of the backup, and determining that the portion of the backup corresponds to the statistical anomaly based on the ratio; and an entropy detector communicatively coupled to the statistical filter and configured to: generate an entropy score for the identified portion of the backup, the entropy score representing a randomness of a distribution of bits in a block of a file in the portion of the backup; and determine whether the backup includes the ransomware based on the generated entropy score. a server interface configured to: retrieve, from a storage device, a backup stored by a client device; and transmit information describing whether the backup includes the ransomware for display on the client device; and retrieve, from a storage device, a backup stored by a client device; and transmit information describing whether the backup includes the ransomware for display on the client device; and a ransomware detection module communicatively coupled to the server interface and comprising: a statistical filter configured to: generate a standard pattern of file activities of the client device for a time period; and perform a statistical behavior analysis on the backup based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern, the statistical anomaly corresponding to an abnormal file activity, the portion of the backup comprising a plurality of files and the statistical behavior analysis comprising determining a ratio of a number of file activities associated with the portion of the backup to a total number of the plurality of files in the portion of the backup, and determining that the portion of the backup corresponds to the statistical anomaly based on the ratio; and an entropy detector communicatively coupled to the statistical filter and configured to: generate an entropy score for the identified portion of the backup, the entropy score representing a randomness of a distribution of bits in a block of a file in the portion of the backup; and determine whether the backup includes the ransomware based on the generated entropy score. a statistical filter configured to: generate a standard pattern of file activities of the client device for a time period; and perform a statistical behavior analysis on the backup based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern, the statistical anomaly corresponding to an abnormal file activity, the portion of the backup comprising a plurality of files and the statistical behavior analysis comprising determining a ratio of a number of file activities associated with the portion of the backup to a total number of the plurality of files in the portion of the backup, and determining that the portion of the backup corresponds to the statistical anomaly based on the ratio; and generate a standard pattern of file activities of the client device for a time period; and perform a statistical behavior analysis on the backup based on the standard pattern to identify a portion of the backup corresponding to a statistical anomaly different from the standard pattern, the statistical anomaly corresponding to an abnormal file activity, the portion of the backup comprising a plurality of files and the statistical behavior analysis comprising determining a ratio of a number of file activities associated with the portion of the backup to a total number of the plurality of files in the portion of the backup, and determining that the portion of the backup corresponds to the statistical anomaly based on the ratio; and an entropy detector communicatively coupled to the statistical filter and configured to: generate an entropy score for the identified portion of the backup, the entropy score representing a randomness of a distribution of bits in a block of a file in the portion of the backup; and determine whether the backup includes the ransomware based on the generated entropy score. generate an entropy score for the identified portion of the backup, the entropy score representing a randomness of a distribution of bits in a block of a file in the portion of the backup; and determine whether the backup includes the ransomware based on the generated entropy score.