Steganography detection, or steganalysis, is the process of identifying the presence of hidden information within a cover medium, such as an image file. The rise of sophisticated data-hiding techniques requires equally advanced detection methods. This document outlines the foundational approach for a machine learning (ML) model designed to perform preliminary detection of steganographically altered image files.
How it works
The primary objective of this capability is a ML model that analyzes image files and triggers alerts when structural anomalies consistent with known steganography tools and methods are detected. These methods often leave discernible statistical “footprints” in the image data, particularly in areas like the Least Significant Bit (LSB) planes. Consequently, the detection capability is generally agnostic to payload characteristics, such as language.
The feature can be turned on by request for a tenant for customers with DLP Advanced (L3), but has no further policy or profile implication.
Upon activation, files conforming to the outlined specifications will undergo automated scanning by the model to ascertain the potential presence of steganography, subsequently triggering an alert.To find an alert, please navigate to “Skope IT” – “Alerts” and check for Alert Type “DLP” with Name “All DLP Policies” which under the File section will display “Steganography Detected: true”.
Snippet of File details outlining Steganography detected.
To deactivate Steganographic detection for your tenant, kindly contact us to arrange its deactivation.
Key Constraints and Limitations:
- Structure, Not Content: The model’s analysis focuses strictly on the structural deviations caused by the act of embedding data. It is engineered to identify the presence of steganography, not to extract or decode the hidden content.
- Alert Generation: The model’s output is an alert indicating a probability of steganography. At this stage, this alert will not create an incident with Forensics or guarantee malicious intent, serving instead as a preliminary filtering mechanism for files requiring further scrutiny.
- Common Tool Signatures: The ML model is trained to recognize signatures associated with common steganography tools, ensuring relevance to observed threat vectors.
- Steganography detection is only performed for images (PNG and BMP) sent to Classification service for ML based classification.
- Images under a certain size (less than 250 pixels in height or width) are not considered.