Ransomware races to encrypt as many reachable files as possible before a human or automated defense notices. It has no way to tell which files are real and which are decoys, so it encrypts whatever it finds next, indiscriminately — meaning a canary file scattered anywhere in the tree is just as likely to get hit early as any other file.
A canary (decoy) file defense sprinkles harmless files that are never touched during normal use. A watcher process monitors only those files. The moment ransomware modifies one, the watcher fires — killing the process and isolating the host — long before the scan finishes.
P(canary hit by step k) ≈ 1 − C(N−c, k) / C(N, k)
N = total files, c = canary count, k = files scanned so far
- Canary density — more decoys sprinkled through the tree means the scan statistically trips one sooner, so expected damage drops roughly in proportion.
- Scan speed — how fast the ransomware works through the file list; defense reaction time doesn't change, only how much gets encrypted before detection.
- Files per system — total tree size; a larger tree with the same canary density still gets caught at roughly the same fraction scanned, but a higher absolute file count.
- Canary defense toggle — turn it off to watch the canary-protected run degrade into the same run-to-completion outcome as the undefended baseline.
Both systems share the exact same file layout and scan order each run, so the comparison isolates the effect of the canary trip-wire itself.