Image steganography detection
In one aspect, an illustrative methodology implementing the disclosed techniques includes, by a computing device, determining that an application process includes use of a first image and a second image, one of the first and second images being generated as part of the application process, and detecting a difference in content of the first image or the second image based on a comparison of the first and second images. The method also includes, by the computing device, revoking access to a file that includes at least one of the first and second images based on the detection of the difference in content of one of the first and second images.
1. A method comprising:
determining, by a computing device, that an application process includes use of a first image and a second image, one of the first and second images being generated as part of the application process;
detecting, by the computing device, a difference in content of the first image or the second image based on a comparison of the first and second images, the comparison of the first and second images being in response to one or more indications of image steganography related to the application process including at least a detection of a use of an encryption application programming interface (API) by the application process; and
revoking, by the computing device, access to a file that includes at least one of the first and second images based on the detection of the difference in content of one of the first and second images.
2. The method of claim 1 , wherein the one or more indications of image steganography related to the application process includes a detection that a window of the application process is a foreground window.
3. The method of claim 1 , wherein the one or more indications of image steganography related to the application process includes a detection of a copy and paste of content from a corporate application to a non-corporate application.
4. The method of claim 1 , wherein the one or more indications of image steganography related to the application process includes a detection of a use of a user interface (UI) element indicative of steganography.
5. The method of claim 1 , wherein the comparison of the first and second images includes a comparison of least significant bits (LSBs) of the first and second images.
6. The method of claim 1 , wherein the comparison of the first and second images includes a comparison of most significant bits (MSBs) of the first and second images and a comparison of least significant bits (LSBs) of the first and second images.
7. The method of claim 1 , wherein the comparison of the first and second images is in response to detecting a close of a first file including the first image and a close of a second file including the second image.
8. A system comprising:
a memory; and
one or more processors in communication with the memory and configured to;
determine that an application process includes use of a first image and a second image, one of the first and second images being generated as part of the application process;
detect a difference in content of the first image or the second image based on a comparison of the first and second images, the comparison of the first and second images being in response to one or more indications of image steganography related to the application process including at least a detection of a use of a user interface (UI) element indicative of steganography; and
revoke access to a file that includes at least one of the first and second images based on the detection of the difference in content of one of the first and second images.
9. The system of claim 8 , wherein the one or more indications of image steganography related to the application process includes a detection that a window of the application process is a foreground window.
10. The system of claim 8 , wherein the one or more indications of image steganography related to the application process includes a detection of a use of an encryption application programming interface (API) by the application process.
11. The system of claim 8 , wherein the one or more indications of image steganography related to the application process includes a detection of a copy and paste of content from a corporate application to a non-corporate application.
12. The system of claim 8 , wherein the comparison of the first and second images includes a comparison of least significant bits (LSBs) of the first and second images.
13. The system of claim 8 , wherein the comparison of the first and second images includes a comparison of most significant bits (MSBs) of the first and second images and a comparison of least significant bits (LSBs) of the first and second images.