A computer implemented method of identifying an encryption algorithm used by a ransomware algorithm, the ransomware algorithm encrypting a data store of a target computer system using a searchable encryption algorithm, the method including intercepting an ordered plurality of messages communicated from the target computer system to a ransomware server computer system, each message including a payload storing an encrypted unit of data from the target computer system; inspecting a final byte in the encrypted unit of data in each message to identify a byte value used by an encryption algorithm of the ransomware as a padding byte to pad messages to the size of an integral multiple of units of encryption for the encryption algorithm; training an autoencoder based on a position of a message in the ordered plurality of messages and the padding byte to provide a trained autoencoder adapted to differentiate the encryption algorithm used by the ransomware from other different encryption algorithms.