BACKGROUND

Steganography is the practice of concealing information, such as a secret message, within ordinary digital media without changing its perceptual quality (e.g., its visible or audible quality). With steganography, the ordinary digital media within which the secret message is hidden (also known as a carrier) is perceptible, whereas the secret message is substantially imperceptible such that a person viewing/listening to the digital media is not aware of the existence of the secret message. The goal of steganography is to hide the very presence of a communication (i.e., communication of the secret message). This differs from cryptography which seeks to make a communication unintelligible by a third party who does not possess the right keys, but does not attempt to hide that a secret message is being sent.

SUMMARY

This Summary is provided to introduce a selection of concepts in simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key or essential features or combinations of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

It is appreciated herein that, although some organizations may provide security controls for protecting sensitive content, such controls may not be effective at protecting such content from various forms of insider threats. For example, one such form of insider threat involves the use of image steganography. Image steganography refers to the technique of unobtrusively hiding information (i.e., sensitive content) within the noisy regions of an image to obtain a “stegno-image” and retrieving the hidden information from the stegno-image at the destination. For added security, the hidden information can also be encrypted, thereby increasing the perceived randomness and decreasing the likelihood of information discovery even in cases where the existence of the hidden information is detected. However, endpoint security control solutions deployed by an organization are unable to detect, with any certainty, the presence of concealed information in an image without having intimate knowledge of the specific encoding/encryption mechanism used to hide the information in the image. Moreover, such security control solutions that attempt to detect data exfiltration at egress points are rendered ineffective against a bad actor who may just copy the stegno-image to a portable data storage device, such as a USB drive, and never go via the egress points. Embodiments of the present disclosure provide solutions to these and other technical problems described herein.

In accordance with one example embodiment provided to illustrate the broader concepts, systems, and techniques described herein, a method may include, by a computing device, determining that an application process includes use of a first image and a second image, one of the first and second images being generated as part of the application process, and detecting a difference in content of the first image or the second image based on a comparison of the first and second images. The method may also include, by the computing device, revoking access to a file that includes at least one of the first and second images based on the detection of the difference in content of one of the first and second images.

According to another illustrative embodiment provided to illustrate the broader concepts described herein, a system includes a memory and one or more processors in communication with the memory. The processor may be configured to determine that an application process includes use of a first image and a second image, one of the first and second images being generated as part of the application process, and detect a difference in content of the first image or the second image based on a comparison of the first and second images. The processor may be further configured to revoke access to a file that includes at least one of the first and second images based on the detection of the difference in content of one of the first and second images.

According to another illustrative embodiment provided to illustrate the broader concepts described herein, a method may include, by a computing device, determining that an application process includes use of a plurality of images, one of the plurality being generated as part of the application process, and detecting a call to encrypt content included in a file, the call being initiated as part of the application process, and the file including one of the plurality of images. The method may also include, by the computing device, revoking access to the file based on the detected call to encrypt the file and use, by the application process, of the plurality of images.

According to another illustrative embodiment provided to illustrate the broader concepts described herein, a system includes a memory and one or more processors in communication with the memory. The processor may be configured to determine that an application process includes use of a plurality of images, one of the plurality being generated as part of the application process, and detect a call to encrypt content included in a file, the call being initiated as part of the application process, and the file including one of the plurality of images. The processor may be further configured to revoke access to the file based on the detected call to encrypt the file and use, by the application process, of the plurality of images.

