See blog post: https://medium.com/@cybersiftIO/anomaly-detection-vs-ransomware-b83510a3a860

ransomware_stats.go

package main

import (
	"github.com/gonum/stat"
	"gopkg.in/h2non/filetype.v1"
	"log"
	"io/ioutil"
	"os"
	"gopkg.in/h2non/filetype.v1/types"
	"fmt"
)

func calcKullbackLeibler(data []uint8) float64{
	var histogram = make([]float64, 256);
	var normal_histogram = make([]float64, 256);
	var total = 0.0

	for i := range (data) {
		histogram[data[i]]++
		total++
	}

	for j := range (histogram) {
		histogram[j]=histogram[j]/total
		normal_histogram[j]=float64(1.0/256)
	}


	kullback := stat.KullbackLeibler(normal_histogram, histogram)
	return kullback
}

func calcSkewness (data []float64) float64 {
	skewness := stat.Skew(data, nil);
	return skewness;
}

func calcKurtosis (data []float64) float64 {
	kurtosis := stat.ExKurtosis(data, nil);
	return kurtosis;
}

func calcShannon(data []uint8) float64 {
	var entropy = float64(0);
	var histogram = make([]float64, 256);
	var total = 0.0

	for i := range (data) {
		histogram[data[i]]++
		total++
	}

	for j := range (histogram) {
		histogram[j]=histogram[j]/total
	}

	entropy = stat.Entropy(histogram)
	return entropy;
}

func getFileType(buf []uint8) types.Type{
	kind, _ := filetype.Match(buf)
	return kind
}

func getFileStats(filename string) {

	data, err := ioutil.ReadFile(filename);
	if err != nil {
		log.Println(err);
		return;
	}

	var float_data = make([]float64, len(data))
	for i := range(data){
		float_data[i] = float64(data[i])
	}

	kind := getFileType(data);
	fmt.Printf(",%s,%s,%s,%g,%g,%g,%g\n", filename, kind.Extension, kind.MIME.Value, calcShannon(data), calcSkewness(float_data),calcKurtosis(float_data), calcKullbackLeibler(data));
}

func main() {
	log.SetOutput(os.Stdout)
	files, _ := ioutil.ReadDir("/home/dvas0004/RansomSift/")
 	for _, file := range files {
		    getFileStats("/home/dvas0004/RansomSift/"+file.Name())
	}
}