Preventing ransomware attacks by detecting suspicious levels of file system activity

Assume a Windows 8/10 home/small office system with 3-4 users and a few TB of file share (say 6TB in a suitable RAID). Most files are static, but sometimes files get moved round or modified. But if overwriting/deleting starts to happen at too great a rate (number of files/sustained rate) it could be a sign of malicious activity and an event should be triggered to alert a user or respond to it.

If it were due to a ransomlocker style of attack, and the file modding can be detected and halted in the first 5/30 minutes the odds are fairly good that any damage will be localised or other backups may exist for the same/similar data, so it can be lived with. (My reason for this view is that it takes 10-20 hours just to stream a 4TB drive for copying locally; encrypting a 6TB RAID will be much slower due to constant read-write of the source drives)

The problem is that file ACLs aren't intended for more than a binary "unlimited permission"/"zero permission". That doesn't work for other malware issues (bad attachments/downloads etc) and doesn't help here. I'd like some kind of ongoing "sanity check" on how much and what kind of activity is being done with that access. But I also don't want to slow down file handling when it is legitimate, unless actual suspicious access is detected.

What kinds of techniques can be used so that if a malicious process somehow managed to get executed on the device or LAN, and began a cycle of high speed "read-modify-overwrite" or "read-savenewfile-deleteoriginal" on a device, the resulting file activity could be alerted by that device as suspicious?

So the target of detection is the insane flurry of file activity a ransomlocker-type attack would kick off. It would be very hard to conceal, sustained, and very distinctive/abnormal. It should make ransomlocker style attacks the easiest to prevent. But how would one go about watching for it?