DETECTION OF STEGANOGRAPHY ON THE PERIMETER

• US 20160283746A1
• Filed: 03/27/2015
• Published: 09/29/2016
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Boshoff, Dusty, Butler, Anthony M.
• Granted Patent: US 10,834,289 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04N 1/32149 Methods relating to embedding, encoding, decoding, detection or retrieval operations
• CPC Class Codes: H04N 1/32352 Controlling detectability or arrangements to facilitate detection or retrieval of the embedded information, e.g. using markers for decoding, detection or retrieval operations H04N1/32149 and subgroups take precedence
• CPC Class Codes: H04N 1/4446 Hiding of documents or document information

Abstract

A method to detect a plurality of steganography based information embedded in a multimedia file associated with an online computer environment is provided. The method may include detecting the multimedia file entering or exiting an online environment associated with a network or an organization. The method may also include comparing a stored hashed version of the detected multimedia file to the detected version of the multimedia file. The method may also include comparing a stored perceptual hashed version of the detected multimedia file to the detected version of the multimedia file based on the detected multimedia file not matching the stored hashed version of the detected multimedia file. The method may further include assigning a flag attribute to the detected multimedia file based on the detected multimedia file matching the stored perceptual hashed version of the detected multimedia file.

Claims

1. A method to detect a plurality of steganography based information embedded in a multimedia file associated with an online computer environment, the method comprising:

detecting the multimedia file entering or exiting an online environment associated with a network or an organization;

comparing a stored hashed version of the detected multimedia file to the detected version of the multimedia file;

comparing a stored perceptual hashed version of the detected multimedia file to the detected version of the multimedia file based on the detected multimedia file not matching the stored hashed version of the detected multimedia file; and

assigning a flag attribute to the detected multimedia file based on the detected multimedia file matching the stored perceptual hashed version of the detected multimedia file.

2. The method of claim 1, further comprising:

creating a profile for the detected multimedia file based on the detected multimedia file matching the stored hashed version of the detected multimedia file or the detected multimedia file not matching the stored perceptual hashed version of the detected multimedia file.

3. The method of claim 2, wherein the created profile comprises labelling the detected multimedia file.

4. The method of claim 3, wherein the labelling of the detected multimedia file comprises attaching an image or attaching a watermark in the detected multimedia file, wherein the attached image or attached watermark describes the user identification information that downloaded or transferred the detected multimedia file.

5. The method of claim 1, wherein the stored perceptual hashed version of the detected multimedia file comprises a captured image of the detected multimedia file at the time the detected multimedia file was created or first entered the online environment.

6. The method of claim 1, wherein the stored hashed version of the detected multimedia file comprises a plurality of information associated with the detected multimedia file, wherein the plurality of information comprises a plurality of bits and bytes.

7. The method of claim 1, further comprising:

collecting a plurality of statistics and information about the detected multimedia file including at least one of a size, a plurality of perceptual hash information, a plurality of bit level hash information, a plurality of byte file size information, a source, a destination, a user, and a machine.

8. A computer system to detect a plurality of steganography based information embedded in a multimedia file associated with an online computer environment, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising;

detecting the multimedia file entering or exiting an online environment associated with a network or an organization;

comparing a stored hashed version of the detected multimedia file to the detected version of the multimedia file;

comparing a stored perceptual hashed version of the detected multimedia file to the detected version of the multimedia file based on the detected multimedia file not matching the stored hashed version of the detected multimedia file; and

assigning a flag attribute to the detected multimedia file based on the detected multimedia file matching the stored perceptual hashed version of the detected multimedia file.

9. The computer system of claim 8, further comprising:

creating a profile for the detected multimedia file based on the detected multimedia file matching the stored hashed version of the detected multimedia file or the detected multimedia file not matching the stored perceptual hashed version of the detected multimedia file.

10. The computer system of claim 9, wherein the created profile comprises labelling the detected multimedia file.

11. The computer system of claim 10, wherein the labelling of the detected multimedia file comprises attaching an image or attaching a watermark in the detected multimedia file, wherein the attached image or attached watermark describes the user identification information that downloaded or transferred the detected multimedia file.

12. The computer system of claim 8, wherein the stored perceptual hashed version of the detected multimedia file comprises a captured image of the detected multimedia file at the time the detected multimedia file was created or first entered the online environment.

13. The computer system of claim 8 wherein the stored hashed version of the detected multimedia file comprises a plurality of information associated with the detected multimedia file, wherein the plurality of information comprises a plurality of bits and bytes.

14. The computer system of claim 8, further comprising:

collecting a plurality of statistics and information about the detected multimedia file including at least one of a size, a plurality of perceptual hash information, a plurality of bit level hash information, a plurality of byte file size information, a source, a destination, a user, and a machine.

15. A computer program product to detect a plurality of steganography based information embedded in a multimedia file associated with an online computer environment, the computer program product comprising:

one or more computer-readable storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions executable by a processor, the program instructions comprising;

program instruction to detect the multimedia file entering or exiting an online environment associated with a network or an organization;

program instruction to compare a stored hashed version of the detected multimedia file to the detected version of the multimedia file;

program instruction to compare a stored perceptual hashed version of the detected multimedia file to the detected version of the multimedia file based on the detected multimedia file not matching the stored hashed version of the detected multimedia file; and

program instruction to assign a flag attribute to the detected multimedia file based on the detected multimedia file matching the stored perceptual hashed version of the detected multimedia file.

16. The computer program product of claim 15, further comprising:

creating a profile for the detected multimedia file based on the detected multimedia file matching the stored hashed version of the detected multimedia file or the detected multimedia file not matching the stored perceptual hashed version of the detected multimedia file.

17. The computer program product of claim 16, wherein the created profile comprises labelling the detected multimedia file.

18. The computer program product of claim 17, wherein the labelling of the detected multimedia file comprises attaching an image or attaching a watermark in the detected multimedia file, wherein the attached image or attached watermark describes the user identification information that downloaded or transferred the detected multimedia file.

19. The computer program product of claim 15, wherein the stored perceptual hashed version of the detected multimedia file comprises a captured image of the detected multimedia file at the time the detected multimedia file was created or first entered the online environment.

20. The computer program product of claim 15, wherein the stored hashed version of the detected multimedia file comprises a plurality of information associated with the detected multimedia file, wherein the plurality of information comprises a plurality of bits and bytes.