This study presents a groundbreaking approach to the ever-evolving challenge of ransomware detection. A lot of detection methods predominantly rely on pinpointing high-entropy blocks, which is a hallmark of the encryption techniques commonly employed in ransomware. These blocks, typically difficult to recover, serve as key indicators of malicious activity. So far, many neutralization techniques have been introduced so that ransomware utilizing standard encryption can effectively bypass these entropy-based detection systems. However, these have limited capabilities or require relatively high computational costs. To address these problems, we introduce a new concept entropy sharing. This method can be seamlessly integrated with every type of cryptographic algorithm and is also composed of lightweight operations, masking the high-entropy blocks undetectable. In addition, the proposed method cannot be easily nullified, contrary to simple encoding methods, without knowing the order of shares. Our findings demonstrate that entropy sharing can effectively bypass entropy-based detection systems. Ransomware utilizing such attack methods can cause significant damage, as they are difficult to detect through conventional detection methods.

In order‐preserving encryption, it was discovered that utilising a hypergeometric probability distribution exposed information about half of the plaintext bits and their respective distances. To address this vulnerability, mutable order‐preserving encoding was introduced as a solution, but it still suffered from revealing the plaintext distribution and exhibiting high correlation. In an effort to overcome these limitations, Lee and Jho proposed a multi‐tree approach that utilises the binary tree invariant and its inverse, resulting in increased complexity for client operations. In this paper, we propose a novel multi‐tree approach to mutable order‐preserving encoding that, by introducing a secret offset at the client side, not only simplifies the server‐side structure but also reduces overall system complexity. To validate the effectiveness of our approach, we conducted comprehensive experiments using the TPC‐C benchmark dataset, evaluating encoding time and query performance across varying data scales. The results demonstrate that our scheme achieves 36% higher encoding efficiency compared to existing multi‐tree methods.