Detecting encryption in real-time? Is there anyway to detect encryption in real-time through a common signature or pattern recognition.

Say, a file is being encrypted using an AES-256 cipher, if I have access to the file stream - can I reliably detect an encryption operation?
I am making some assumptions as to the context of the question here, but I think I understand why/what you are asking. The term you are using, "file stream", to me means an ongoing encryption operation on a computer, so I will word my answer accordingly.

Assume you are a filesystem filter driver, and you can view data as it is read from/written to the filesystem, regardless of the specific filesystem used, or the application that is accessing it.

In this case, an encryption operation may appear as both a read operation and a write operation to the same file, or it may appear as a write operation to a different file (temporary) which then takes the place of the original once the operation is complete (through delete and rename).

There are of course some ways you can determine if the file is being encrypted. If there appears to be a sequential series of reads on a specific file, followed either by sequential writes to the same file, or to another file, and the data being written appears to be random (through statistical analysis), then you can assume an encryption operation is taking place, and then perform more detailed analysis on all open files to the process that is accessing the file.

If there is not a corresponding write operation, but rather a similar amount of bandwidth over a network, the same logic applies. Reads may be buffered before writes or network transmission, but there should be a similar averaged amount of data (unless encoding occurs after encryption), and the bandwidth will probably be easy to spot on large files or groups of files.

Looking at individual files may get you nowhere, but sequential file access (maybe by name or date) with corresponding writes or network transmission is more likely to raise flags, especially if what you are looking for is the signature of someone encrypting large amounts of data. Encryption on a small individual file will be difficult to spot if you do not have a historical trend of data access for all processes. Building a record of those trends and a method of analyzing them will be very similar to the heuristics used by antivirus programs when looking for something that is not in their signature database.