  Several cybersecurity domains, such as ransomware detection, forensics and
data analysis, require methods to reliably identify encrypted data fragments.
Typically, current approaches employ statistics derived from byte-level
distribution, such as entropy estimation, to identify encrypted fragments.
However, modern content types use compression techniques which alter data
distribution pushing it closer to the uniform distribution. The result is that
current approaches exhibit unreliable encryption detection performance when
compressed data appears in the dataset. Furthermore, proposed approaches are
typically evaluated over few data types and fragment sizes, making it hard to
assess their practical applicability. This paper compares existing statistical
tests on a large, standardized dataset and shows that current approaches
consistently fail to distinguish encrypted and compressed data on both small
and large fragment sizes. We address these shortcomings and design EnCoD, a
learning-based classifier which can reliably distinguish compressed and
encrypted data. We evaluate EnCoD on a dataset of 16 different file types and
fragment sizes ranging from 512B to 8KB. Our results highlight that EnCoD
outperforms current approaches by a wide margin, with accuracy ranging from ~82
for 512B fragments up to ~92 for 8KB data fragments. Moreover, EnCoD can
pinpoint the exact format of a given data fragment, rather than performing only
binary classification like previous approaches.
