A sensitive information detection method and system based on multi-modal and steganalysis detection

Abstract

The present application relates to the technical field of information security, in particular to a sensitive information detection technology and system based on multi-modal and steganographic detection, which first verifies the real type of a file by using file header information and binary data analysis through a format tampering prevention module to prevent format camouflage attacks; a sensitive data detection module adopts DistilBERT and LSTM structure to pre-process text, extract text embedding, and mine text features through bidirectional LSTM and Attention mechanism to finally accurately determine whether the text contains sensitive information; a joint content and file steganographic detection module fuses convolutional neural network and multi-modal learning, uses corresponding models for steganographic information detection according to different data types, integrates results through multi-modal neural network, and uses multi-modal feedback and cross-modal reasoning mechanism to improve detection accuracy; the present application effectively enhances the accuracy, comprehensiveness and system adaptability of sensitive information detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to a sensitive information detection method and system based on multi-modal and steganography detection, which is used for accurately detecting sensitive information and potential steganography content in multi-modal data and effectively guaranteeing data security. BACKGROUND

[0002] In today's information age, the storage and transmission methods of data are increasingly diversified and complex, and the security threats faced by sensitive information are also increasing. Traditional sensitive information detection methods have many shortcomings: first, from the perspective of data modalities, most methods are limited to detecting single-modal data, such as focusing only on text data or image data, while in actual application scenarios, sensitive information often exists in the form of multi-modal fusion, such as a file may contain both text description and image content, and existing technologies are difficult to effectively integrate and comprehensively analyze these different modal information.

[0003] Secondly, with the continuous development of steganography technology, the means of hiding sensitive information are becoming more and more sophisticated. Criminals can make sensitive information almost blend with ordinary data by modifying the least significant bits of files, using file redundancy space, or using complex encryption hiding algorithms. Traditional detection methods lack the ability to analyze complex steganography technology and are difficult to identify hidden sensitive content.

[0004] In addition, the current sensitive information detection system usually has low processing efficiency when facing large-scale data, and cannot accurately identify potential sensitive information from massive data in real time, which poses a serious challenge to data security.

[0005] Although deep learning, multi-modal analysis and steganography technology are constantly improving, there is currently a lack of a sensitive information detection method and system that can organically integrate these advanced technologies, effectively integrate multi-modal information, have strong steganography detection capabilities, and be efficiently deployed. Therefore, developing a sensitive information detection method and system based on multi-modal and steganography detection is of great significance for improving the accuracy and comprehensiveness of sensitive information detection and guaranteeing data security. SUMMARY

[0006] The present application proposes a sensitive information detection method and system based on multi-modal and steganography detection to address the shortcomings of existing sensitive information detection methods. This method and system organically integrates file format tamper-proofing, sensitive information detection and steganography detection technology, achieving accurate detection of sensitive information in multi-modal data, significantly improving the accuracy, comprehensiveness of detection, and the running efficiency and adaptability of the system.

[0007] The application aims to provide a sensitive information detection method and system based on multi-modal and steganography detection, which can effectively prevent file format tampering from bypassing detection, accurately identify sensitive information in the text, and comprehensively find steganography content hidden in different modal data, providing all-round protection for data security.

[0008] The application provides a sensitive information detection method based on multi-modal and steganography detection, which comprises the following steps:

[0009] receiving a file to be detected;

[0010] performing anti-file format tampering bypass detection, including analyzing file header information, extracting binary structure features and performing format verification to determine the real type of the file;

[0011] Based on the real type, perform sensitive information detection, including: after preprocessing the text, use the DistilBERT model to extract the text embedding vector, capture the long-term dependence features of the text and focus on the sensitive area through the bidirectional LSTM and Attention mechanism, and use the full connection layer to determine whether the text contains sensitive information;

[0012] Perform joint content and file steganography detection, including: using the Transformer, LSTM and CNN models for steganography feature extraction for text, file binary structure and image respectively, constructing a multi-modal neural network to integrate different modal detection results, and applying a cross-modal reasoning mechanism to cross-verify different modal features to improve detection accuracy;

[0013] Output the comprehensive detection results, including file format risk rating, sensitive information distribution and category, and steganography information location and content.

[0014] As a preferred, the anti-file format tampering bypass detection specifically comprises:

[0015] Based on the file header magic number to identify the real type of the file;

[0016] Use the sliding window hash check algorithm to extract and verify the header sample information;

[0017] Analyze the binary data structure of the file, calculate the byte frequency feature and the data block entropy feature;

[0018] Compare the extracted feature vector with the feature library to determine the most possible real type of the file;

[0019] Output the file format tampering risk level evaluation result.

[0020] As a preferred, the feature vector and the feature library are compared for similarity, which comprises:

[0021] Calculate the cosine similarity of the extracted feature vector and the standard vector in the feature library;

[0022] Based on the similarity calculation result, determine the real type of the file;

[0023] Record the inconsistency between the declared type and the real type of the file, and form a risk assessment report.

[0024] As a preferred, the sensitive information detection specifically includes:

[0025] Perform a cleaning operation on the text to remove HTML tags and special symbols;

[0026] Apply a multi-level sensitive word dictionary for matching, including basic sensitive words, synonyms, fuzzy words, and domain-specific sensitive words;

[0027] According to the language type of the text, select the appropriate segmentation tool to perform segmentation and word shape restoration;

[0028] Load the pre-trained DistilBERT model to extract context-aware text embedding vectors;

[0029] Build a bidirectional LSTM network to process embedded vectors, capturing long-term dependencies in text through forward and backward;

[0030] Introduce the Attention mechanism to calculate attention weights and highlight key areas of sensitive information;

[0031] Use the full connection layer and Sigmoid function to determine whether the text contains sensitive information and generate a detailed report.

[0032] As a preferred, the joint content and file steganography detection specifically includes:

[0033] For the text part, use the Transformer model to analyze the document context and detect steganographic information hidden by tiny character changes;

[0034] For the file binary structure, use the LSTM model to analyze the file binary data sequence features and detect embedded data;

[0035] For the image part, use the CNN model to analyze the image pixel-level changes and identify hidden information;

[0036] Integrate the detection results of different modalities through a multi-modal neural network for comprehensive analysis;

[0037] Apply cross-modal reasoning mechanisms to improve detection accuracy and robustness, and output steganographic detection results.

[0038] As a preferred, the multi-modal neural network includes:

[0039] Design a Transformer encoder input layer for the text modality;

[0040] Design an LSTM input layer for the binary structure modality;

[0041] Design a CNN feature extraction layer for the image modality;

[0042] Construct a feature fusion network based on attention mechanism to automatically learn the correlation and weight between different modalities;

[0043] Output the fused multi-modal feature representation for subsequent steganographic information detection and judgment.

[0044] As a preferred, the cross-modal reasoning mechanism comprises:

[0045] Establish three groups of associated networks of text-image, text-binary, and image-binary;

[0046] Construct the mapping relationship between different modalities;

[0047] Based on the detection results and feature clues of different modalities, cross-validation reasoning is performed;

[0048] Solve the conflict between the detection results of different modalities and improve the confidence of steganographic detection;

[0049] Form the final steganographic information detection conclusion.

[0050] As a preferred, in the sensitive information detection:

[0051] The output of the bidirectional LSTM at time t is where and are the hidden states of the forward and backward LSTMs, respectively;

[0052] The attention mechanism calculates the attention weight where , to obtain the context vector ;

[0053] The context vector c is passed through a fully connected layer to obtain the sensitive information judgment probability.

[0054] As a preferred, the following steps are further included:

[0055] Generate a comprehensive security assessment report based on the detection results;

[0056] Provide risk level assessment for the discovered sensitive information and steganographic content;

[0057] Label and isolate the files confirmed to contain threats;

[0058] The detection result is fed back to the security management system for subsequent threat analysis and defense strategy updating.

[0059] The sensitive information detection system based on multi-modal and steganography detection comprises:

[0060] The file format tampering prevention detection module is used for analyzing file header information, extracting binary structure features and performing format verification to determine the real type of the file.

[0061] The sensitive information detection module is used for preprocessing the text, extracting text embedding vectors by using a DistilBERT model, capturing text features and focusing on sensitive areas by using a bidirectional LSTM and an Attention mechanism, and determining sensitive information by using a full connection layer.

[0062] The joint content and file steganography detection module is used for performing steganography detection on text, file binary structure and image by using a Transformer, an LSTM and a CNN model respectively, and constructing a multi-modal neural network and a cross-modal reasoning mechanism to integrate and analyze detection results.

[0063] The result output module is used for generating and outputting comprehensive detection results, including file format risk rating, sensitive information distribution and category, and steganography information position and content.

[0064] The beneficial effects of the present application are:

[0065] 1. By organically integrating file format tampering prevention, sensitive information detection and steganography detection technologies, a complete protection chain from file verification to content detection to steganography recognition is constructed, and the comprehensiveness and security of sensitive information detection are significantly improved.

[0066] 2. The deep learning architecture based on the combination of DistilBERT and bidirectional LSTM is used for sensitive information detection, which can effectively identify transformed sensitive words and context sensitive information in the text, and improve the accuracy and efficiency of detection.

[0067] 3. The cross-modal reasoning mechanism is innovatively introduced, and the accuracy and robustness of steganography detection are further improved through cross-validation and reasoning of different modal information, which effectively prevents complex steganography means.

[0068] 4. The system architecture design is reasonable, the processing flow is clear, and it is suitable for real-time detection of large-scale data and has wide application prospects. BRIEF DESCRIPTION OF DRAWINGS

[0069] Figure 1 It is a general framework diagram of the sensitive information detection method and system based on multi-modal and steganography detection.

[0070] Figure 2A schematic diagram of the file format tampering prevention bypass detection module of the present application;

[0071] Figure 3 A schematic diagram of the sensitive information detection module based on the DistilBERT-LSTM structure of the present application;

[0072] Figure 4 A schematic diagram of the joint content and file steganographic detection module of the present application;

[0073] Figure 5 A schematic diagram of the bidirectional LSTM model of the present application. DETAILED DESCRIPTION

[0074] Please refer to the accompanying Figures 1-5 , the present application will be further described in detail below in conjunction with the drawings and specific embodiments. It should be noted that the implementation of the present application is not limited to this, under the inspiration of the present application, those skilled in the art can make various equivalent transformations or modifications without departing from the spirit of the present application, and these equivalent transformations or modifications all belong to the protection scope of the present application.

[0075] Example 1: overall flow of sensitive information detection method based on multi-modal and steganographic detection

[0076] As shown in Figure 1 , the sensitive information detection method based on multi-modal and steganographic detection provided by the present application mainly includes the following steps:

[0077] First, receive the file to be detected. The system receives the file that needs to be detected for sensitive information from the user or other systems, which can be various formats of documents, images, compressed packages, etc.

[0078] Second, perform file format tampering prevention bypass detection. This step aims to prevent attackers from disguising file types (such as disguising executable files as picture files) by modifying file extensions or tampering with binary data, thereby bypassing security detection. By analyzing the file header information, extracting binary structure features and performing format verification, the true type of the file is determined, such as JPEG, PDF, etc., and the file is classified by type and the format tampering risk level is recorded.

[0079] Then, based on the determined true type, perform sensitive information detection. This step combines DistilBERT and LSTM structure, pre-processes the text, uses DistilBERT model to extract text embedding vectors, captures long-term dependency features of text and focuses on sensitive areas through bidirectional LSTM and Attention mechanism, uses fully connected layer to determine whether the text contains sensitive information, and finally generates a detailed report combining the sensitive dictionary matching results to clearly identify the category and location of sensitive information.

[0080] Next, joint content and file steganography detection is performed. This step combines convolutional neural networks and multi-modal learning, using Transformer, LSTM, and CNN models to detect steganographic information for text, file binary structure, and images, respectively. Then, a multi-modal neural network is used for comprehensive analysis, leveraging cross-modal reasoning mechanisms to improve detection accuracy and robustness, and outputting steganographic detection results and related information.

[0081] Finally, the comprehensive detection results are output. The system integrates the detection results from the previous steps to generate a comprehensive report containing file format risk ratings, sensitive information distribution and categories, and steganographic information location and content, providing a basis for subsequent decision-making and processing.

[0082] The above steps form a complete detection process, with clear logical connections between each step, with the output of the previous step serving as the input for the next step, collectively achieving comprehensive detection of sensitive information in multi-modal data.

[0083] Embodiment 2: Anti-file format tampering bypass detection

[0084] As shown in Figure 2 , this embodiment describes the specific steps of anti-file format tampering bypass detection in detail.

[0085] First, file true type identification is performed based on file header magic number. The specific hexadecimal byte sequence in the file header, i.e., the magic number, is the key basis for identifying the true type of the file, and does not rely on the file extension which is easily tampered with. For example, the magic number of a GIF file is [474946383761], and the magic number of a JPEG file is [FFD8FF]. The system uses an efficient byte reading algorithm to locate the starting position of the file, extracts the appropriate amount of byte data at the beginning, and accurately compares it with the pre-stored standard magic numbers of various types of files. This process strictly follows the byte order and value matching principle. Once a match is found, the true format of the file can be determined with certainty, effectively preventing attackers from disguising files by changing the file extension.

[0086] Second, the sliding window hash verification algorithm is used to extract and verify the header sample information. Based on the statistical characteristics and information entropy of the file type, the algorithm determines an appropriate sliding window length (commonly 128-512 bytes) and moves the window from the starting position of the file at a fixed step size to extract byte data as the header sample. The SHA-256 hash value of the header sample is calculated and compared with the pre-stored standard template hash value set of various types of file headers. If a match is found, a byte-by-byte accurate comparison is performed to confirm the integrity and accuracy of the header information, thereby enhancing the judgment basis for the true format of the file.

[0087] Next, the file binary data structure is parsed, and byte frequency features and data block entropy value features are calculated. The binary structure of the file is analyzed through professional tools to identify key features such as the directory structure and data block distribution of the file. The frequency distribution of each byte in the file is calculated to form a feature vector; at the same time, the file is divided into multiple data blocks, and the entropy value of each block is calculated to form an entropy value vector. These features are unique to different types of files and can be used as important evidence to determine the true type of the file.

[0088] Then, the extracted feature vector is compared with the feature library for similarity. The system calculates the cosine similarity between the extracted feature vector and the standard vector in the feature library, and determines the most likely true type of the file by the size of the similarity. The cosine similarity calculation formula is:

[0089] ,

[0090] wherein, and represent the extracted feature vector and the standard vector in the feature library, and represent the th element in the vector, represent the dimension of the vector. The closer the similarity value is to 1, the more similar the two vectors are, and the more likely the true type of the file is consistent with the type corresponding to the standard vector.

[0091] Finally, the file format tampering risk level evaluation result is output. Based on the results of the previous detection steps, the system records the inconsistency between the declared type of the file (represented by the extension) and the actual detected type, and according to the degree and nature of the inconsistency, the risk level is divided into low, medium and high three levels. At the same time, a detailed evaluation report is generated, including the true type of the file, the declared type, the risk level and the potential security threat, providing reliable file type information for subsequent sensitive information detection.

[0092] Through the above steps, the system can effectively prevent attackers from bypassing detection through format tampering, ensure that subsequent sensitive information detection and steganography detection are based on the true type of the file, and improve the security and accuracy of the entire detection process.

[0093] Embodiment 3: Sensitive information detection based on DistilBERT-LSTM structure

[0094] As shown in Figure 3 , this embodiment describes in detail the specific steps of sensitive information detection based on the DistilBERT-LSTM structure.

[0095] Firstly, text cleaning is performed to remove HTML tags and special symbols. The system uses regular expressions to match and delete HTML tags, special characters, and redundant white space characters in the text, leaving only the pure text content. This step ensures the purity of the text to be analyzed, reducing noise interference and providing a good foundation for subsequent sensitive information analysis.

[0096] Secondly, a multi-level sensitive word dictionary is applied for matching. The system constructs a multi-level sensitive word dictionary containing basic sensitive words, synonyms, fuzzy words, and domain-specific sensitive words. After cleaning the text, it is matched word by word. When sensitive words in the dictionary are found in the text, the system will directly mark these words and record their location information in the text. This preliminary screening can quickly identify obvious sensitive content and provide a focus area for subsequent in-depth analysis.

[0097] Then, according to the language type of the text, the appropriate segmentation tool is selected and executed for word segmentation and lemmatization. For Chinese text, the system uses the jieba segmentation tool; for English text, the NLTK toolkit is used. After segmentation, the system also performs lemmatization on each word, such as reducing running to run" and mice to mouse, so that the model can more accurately understand and process the semantic information in the text.

[0098] Next, the pre-trained DistilBERT model is loaded to extract context-aware text embedding vectors. DistilBERT is a lightweight version of BERT, retaining most of the performance of BERT but reducing the model size by about 40% and increasing the inference speed by about 60%. The system inputs the segmented and lemmatized text into the DistilBERT model, and through the Transformer encoder in the model, it deeply understands and encodes the semantic relationships in the text, extracting the embedding vector representation of the text. These embedding vectors can effectively capture the context information in the text, including semantic associations between words, sentence structure, and grammatical relationships.

[0099] Subsequently, a bidirectional LSTM network is constructed to process the embedding vectors and capture long-term dependencies in the text through forward and backward processing. Figure 5 As shown in FIG. 1, the bidirectional LSTM is composed of a forward LSTM and a backward LSTM, which can simultaneously process the forward and backward context information of the text. Let the sequence of text embedding vectors output by the DistilBERT model be where is the embedding vector at the th time step, with a dimension of . The output of the bidirectional LSTM at time t is:

[0100] ,

[0101] in, and The hidden states of the forward and backward LSTMs are concatenated to form the final output vector, which has a dimension of 2D. This structure can effectively capture long-range dependencies in text, providing richer feature representations for the accurate identification of sensitive information.

[0102] Then, an attention mechanism is introduced to calculate attention weights, highlighting key regions of sensitive information. This is then applied to the output of the bidirectional LSTM. Building upon this foundation, the system introduces an attention mechanism to automatically learn the importance weights at different time steps. First, the attention score is calculated:

[0103] ,

[0104] in, (dimension is) )and (dimension is) The parameters are learnable. Then, the scores are normalized into weights using the softmax function:

[0105] ,

[0106] Finally, the LSTM output is weighted and summed using these weights to obtain the context vector:

[0107] ,

[0108] This context vector It can highlight key parts of the text that are related to sensitive information, enabling the system to more accurately identify and locate sensitive content.

[0109] Finally, a fully connected layer and a sigmoid function are used to determine whether the text contains sensitive information and generate a detailed report. The system inputs the context vector c into the fully connected layer, and the sigmoid activation function maps the output to probability values ​​between 0 and 1, representing the likelihood that the text contains sensitive information.

[0110] ,

[0111] in, and These are the parameters of the fully connected layer. Sigmoid function. If the probability value exceeds a preset threshold (usually 0.5), it is determined that the text contains sensitive information. The system generates a detailed sensitive information detection report in combination with the aforementioned sensitive word dictionary matching results, including the category of sensitive information (such as business secrets, personal privacy, political sensitivity, etc.), location (starting and ending position in the text), and credibility score, etc. information, providing an important basis for subsequent security processing.

[0112] Through the above steps, the sensitive information detection based on the DistilBERT-LSTM structure can effectively identify explicit and implicit sensitive content in the text, with high accuracy and efficiency.

[0113] Example 4: Joint content and file steganography detection

[0114] As shown in Figure 4 , this embodiment describes the specific steps of joint content and file steganography detection in detail.

[0115] First, for the text part, the Transformer model is used to analyze the document context and detect steganographic information hidden by minor character changes. The system first builds and trains the Transformer model to enable it to learn the differences between normal text and text containing steganographic information. The training data includes a large number of normal text samples and steganographic text samples generated by various text steganography techniques (such as adding or deleting spaces, replacing special characters, etc.). After training, the text to be detected is input into the model, which extracts feature vectors related to steganographic information by deeply analyzing the context relationship, vocabulary distribution, and syntax structure of the text. These feature vectors can reflect the abnormal patterns that may exist in the text, such as unnaturalness of vocabulary use, abnormality of semantic coherence, etc. Based on these features, the system uses a classifier to determine whether the text contains steganographic information and attempts to extract potential hidden data.

[0116] Second, for the file binary structure, the LSTM model is used to analyze the sequence characteristics of file binary data and detect embedded data. The system builds an LSTM model and trains it with a large amount of binary data containing steganographic data and normal files, enabling the model to learn and recognize steganographic patterns in binary data. The model focuses on the binary structure features of the file, such as the arrangement of data blocks, the frequency of occurrence of specific byte sequences, etc. For the file to be detected, the system inputs its binary data into the trained LSTM model, which extracts feature representations related to steganographic information by analyzing the data sequence. These features can reveal abnormal patterns in the file binary data, such as the embedding location of hidden data and data anomalies. Based on these features, the system determines whether the file contains binary steganography and locates the possible hidden data location.

[0117] Then, for the image part, a CNN model is used to analyze the pixel-level changes in the image and identify hidden information. The system builds a CNN model and trains it with a large number of images containing steganography and images without steganography. The CNN model focuses on analyzing the pixel-level features of the image and can effectively identify the small pixel changes caused by steganography. For the image to be detected, the system inputs it into the trained CNN model, and the model extracts feature maps of the image through convolution and pooling operations. These feature maps reflect the possible steganography traces in the image, such as abnormal distribution of pixel values, abnormal changes in color channels, etc. Based on these features, the system uses a classifier to determine whether the image contains steganography information.

[0118] Next, a multi-modal neural network is constructed to integrate the feature information of different modalities for comprehensive analysis. The system designs a multi-modal neural network based on attention mechanism, taking the detection results of the three modalities (text, binary, and image) as input. The network designs a special input layer for each modality: the text modality uses a Transformer encoder, the binary structure modality uses an LSTM layer, and the image modality uses a CNN feature extraction layer. After processing by the respective layers, the features of different modalities are sent to the multi-modal fusion network, which automatically learns the relevance and importance weights between different modalities through attention mechanism, achieving effective fusion of features. The fused feature representation can comprehensively reflect the possible steganography information in the file, providing more comprehensive detection basis.

[0119] Finally, a cross-modal reasoning mechanism is applied to improve detection accuracy and robustness, and the steganography detection result is output. The system constructs three groups of associated networks: text-image, text-binary, and image-binary, establishing the mapping relationship between different modalities. Through these associated networks, the system can perform cross-modal reasoning, such as when the text detection finds suspicious steganography features, the system will check whether the related image or binary data also has abnormalities, thereby cross- verifying the existence of steganography information. This cross-modal reasoning mechanism can effectively solve the bias and uncertainty that may occur in single modality detection, improving the overall detection accuracy and robustness of the system. Finally, the system outputs the comprehensive steganography detection result, including whether the file contains steganography information, the type of steganography information, the possible location, and the extracted hidden content, etc., providing comprehensive information support for subsequent security processing.

[0120] Through the above steps, the joint content and file steganography detection can comprehensively discover the steganography content hidden in different modalities of data, effectively preventing data leakage and security threats.

[0121] Example 5: Implementation of Cross-Modality Reasoning Mechanism

[0122] This example describes the specific implementation method of the cross-modality reasoning mechanism.

[0123] The cross-modal reasoning mechanism is one of the core innovations of the present invention. It establishes the correlation between different modal data, realizes cross-validation and comprehensive reasoning of information, and improves the accuracy and robustness of steganography detection. The implementation of this mechanism mainly includes the following steps:

[0124] First, an information correlation model is established. The system designs and trains three correlation models: text-image correlation model, text-binary correlation model, and image-binary correlation model. These models use deep neural network structure and can learn the semantic mapping relationship between different modal data. For example, the text-image correlation model can learn the correspondence between the visual content of the image and the text description; the text-binary correlation model can learn the correlation between the text content and the binary structural features; and the image-binary correlation model learns the mapping between the image content and its binary representation. These correlation models learn the corresponding relationship between different modal data under normal circumstances through a large amount of training data, providing a benchmark for subsequent anomaly detection.

[0125] Second, cross-modal feature mapping is performed. For the file to be detected, the system uses the above correlation models to map the features of one modality to the feature space of another modality to form expected features. For example, the system can predict the visual features that the relevant image should have according to the text content, or infer the keywords that the corresponding text description should contain according to the image content. These expected features reflect the characteristics that different modal data should exhibit under normal circumstances, and the deviation from the actual features may indicate the presence of steganography information.

[0126] Then, cross-validation and anomaly detection are performed. The system compares the expected features with the actual features and calculates the degree of difference between them. Significant differences may mean that the data has been tampered with or contains steganography information. For example, if there is a significant difference between the image features predicted by the text content and the actual image features, or the text keywords inferred from the image content are missing in the actual text, there may be steganography. The system also analyzes the consistency of the detection results of different modalities. When multiple modalities report anomalies at the same time, the possibility of steganography is higher; when the detection results conflict, the system will further analyze the possible reasons.

[0127] Finally, comprehensive reasoning and decision-making are performed. The system uses reasoning models such as Bayesian networks or decision trees to integrate the detection results from various modalities and the cross-validation information, conducts comprehensive reasoning, and gives the final steganography detection conclusion. The reasoning model considers multiple factors, including the detection confidence of each modality, the cross-modal verification results, historical detection data, etc., and obtains more accurate judgments by weighted fusion of these information. At the same time, the system also provides an explanation of the reasoning process, including which evidence supports the final conclusion and the probability distribution of various possibilities, helping users understand the detection results and make appropriate security decisions.

[0128] Through the above cross-modal reasoning mechanism, the system can overcome the limitations of single-modal detection, achieve more comprehensive and accurate steganalysis, effectively prevent complex steganographic means, and improve the data security protection capability.

[0129] Embodiment 6: Sensitive information detection system based on multi-modal and steganalysis

[0130] As shown in Figure 1 , the embodiment describes the overall architecture and functional modules of the sensitive information detection system based on multi-modal and steganalysis.

[0131] The sensitive information detection system based on multi-modal and steganalysis provided by the present application mainly includes four core modules: a file format tampering bypass detection module, a sensitive information detection module, a joint content and file steganalysis module, and a result output module. These four modules work together to form a complete detection system, which can effectively identify sensitive information and steganographic content in multi-modal data.

[0132] The file format tampering bypass detection module is mainly responsible for verifying the authenticity and integrity of the file. This module analyzes the file header information, extracts the binary structure features, and performs format verification to determine the true type of the file. It contains components such as file header magic number recognition unit, sliding window hash verification unit, binary structure analysis unit, and format verification unit. These components prevent attackers from disguising file types by modifying file extensions or tampering with binary data, ensuring that the subsequent detection process is based on the true type of the file. The output of this module includes the true type judgment of the file, format tampering risk rating, and other information, providing an important basis for subsequent sensitive information detection.

[0133] The sensitive information detection module is based on the DistilBERT-LSTM structure and detects sensitive information in text content. This module contains components such as text preprocessing unit, sensitive word matching unit, DistilBERT encoding unit, bidirectional LSTM processing unit, Attention mechanism unit, and classification judgment unit. The text preprocessing unit is responsible for cleaning the text and removing irrelevant information; the sensitive word matching unit uses a multi-level sensitive word dictionary for preliminary screening; the DistilBERT encoding unit extracts the context embedding vector of the text; the bidirectional LSTM processing unit captures the long-term dependency relationship of the text; the Attention mechanism unit focuses on the sensitive area; and the classification judgment unit finally determines whether the text contains sensitive information. The output of this module is a detailed sensitive information detection report, including the category, location, and credibility score of sensitive information.

[0134] The joint content and file steganography detection module integrates multiple models to comprehensively detect various steganographic information. This module includes components such as text steganography detection unit, file binary steganography detection unit, image steganography detection unit, multi-modal neural network unit, and cross-modal reasoning unit. The text steganography detection unit uses a Transformer model to analyze document context; the file binary steganography detection unit uses an LSTM model to analyze binary sequence features; the image steganography detection unit uses a CNN model to detect pixel-level changes; the multi-modal neural network unit integrates detection results from different modalities; and the cross-modal reasoning unit improves detection accuracy through cross-validation. The output of this module is a comprehensive steganography detection result, including information such as whether steganography exists, steganography type, and location.

[0135] The result output module is responsible for integrating the detection results of the aforementioned modules to generate a final detection report. This module includes components such as result fusion unit, risk assessment unit, report generation unit, and interface adaptation unit. The result fusion unit uniformly processes the detection results of each module; the risk assessment unit assesses the overall security risk of the file; the report generation unit creates a detailed detection report; and the interface adaptation unit ensures that the system can seamlessly interface with other security management systems. The output of this module is a comprehensive security detection report containing detailed information such as file format risk rating, sensitive information distribution and category, and steganographic information location and content.

[0136] There is a clear data flow and control flow relationship between the four modules. The output of the anti-file format tampering bypass detection module serves as the input of the sensitive information detection module and the joint content and file steganography detection module; the sensitive information detection module and the joint content and file steganography detection module work in parallel, and their respective outputs are passed to the result output module; the result output module integrates all information to generate a final report. This modular design makes the system have good scalability and maintainability, while ensuring the integrity and accuracy of the detection process.

[0137] Embodiment 7: Application of the sensitive information detection system based on multi-modal and steganography detection

[0138] This embodiment describes the application of the sensitive information detection system based on multi-modal and steganography detection in actual scenarios.

[0139] The sensitive information detection system based on multi-modal and steganography detection provided by the present application can be widely applied in the fields of government data security, enterprise commercial secret protection, financial information security, and personal privacy protection. The following takes enterprise document security audit as an example to illustrate the application process and effect of the system.

[0140] Firstly, the system receives document files from the enterprise's internal document management platform. These documents may be reports, contracts, technical documents uploaded by employees, and need to be audited for security to prevent sensitive information leakage.

[0141] Secondly, the system performs anti-file format tampering bypass detection. For the received document files, the system analyzes their header information and binary structure to confirm the true type of the file. In some cases, the system successfully identifies a seemingly ordinary PPT file that actually contains executable code, effectively preventing security risks.

[0142] Then, the system performs sensitive information detection based on the true type of the file. For text content, the system uses the DistilBERT-LSTM model for deep analysis, not only identifying obvious sensitive words containing enterprise secrets, but also discovering contextually expressed sensitive information. For example, the system can identify sensitive content related to the company's strategy, such as the third quarter launch plan for the next generation product, even without using restricted words explicitly.

[0143] Next, the system performs joint content and file steganography detection. In one detection, the system found that a seemingly ordinary market report chart contained sensitive information such as a company's customer list. Through multi-modal detection and cross-modal reasoning, the system not only discovered the existence of steganography, but also successfully extracted the hidden content, providing important support for the prevention of internal information leakage for the enterprise.

[0144] Finally, the system generates a comprehensive detection report, including file format risk rating, sensitive information distribution and category, and steganography information location and content. At the same time, according to the enterprise's pre-set security policy, the system marks and isolates files containing sensitive information or steganography content, and feeds back the detection results to the enterprise's security management system for subsequent threat analysis and defense strategy updates.

[0145] Through a period of application, the system has shown significant advantages in enterprise document security auditing: detection accuracy has increased by about 25%, false positive rate has decreased by about 40%, especially in identifying complex steganography and context-sensitive information; processing efficiency has improved by about 30%, meeting the real-time detection needs of large-scale data; the system's scalability and adaptability have also been verified, allowing for flexible adjustments to changing security needs of the enterprise.

[0146] These practical application results prove that the sensitive information detection system based on multi-modal and steganography detection provided by the invention can effectively solve the limitations of traditional detection methods, providing comprehensive and reliable protection for data security, and has broad application prospects.

[0147] The sensitive information detection method and system based on multi-modal and steganography detection provided by the present application has significant industrial applicability and can be widely applied in multiple fields.

[0148] 1. In the field of government data security, the system can help government departments review whether the documents contain state secrets or sensitive information, preventing information leakage and security incidents.

[0149] 2. In the aspect of enterprise commercial secret protection, the system can detect whether internal documents and outgoing materials contain core technology, business strategy, customer information, and other sensitive information, protecting the commercial interests of enterprises.

[0150] 3. In the field of financial information security, the system can identify sensitive financial data and personal information in financial documents to ensure compliance and prevent data leakage.

[0151] 4. In the aspect of personal privacy protection, the system can detect and filter personal sensitive information such as ID numbers, bank accounts, and medical records to prevent privacy infringement.

[0152] 5. In the field of network security protection, the system can be integrated into a larger security architecture as a deep detection component to provide comprehensive data security protection.

[0153] The present application adopts modular design, easy to implement and deploy, can be flexibly configured and optimized according to the needs of different application scenarios, has strong practicality and adaptability. At the same time, the high efficiency and high accuracy of the system can meet the real-time detection needs of large-scale data in practical applications, and has significant industrial value.

[0154] The present application provides a sensitive information detection method and system based on multi-modal and steganography detection, which realizes comprehensive detection of sensitive information in multi-modal data through three core steps of preventing file format tampering bypass detection, sensitive information detection based on DistilBERT-LSTM structure, and joint content and file steganography detection. The system has significant advantages in file authenticity verification, sensitive content identification, and steganography information discovery, and can effectively improve the accuracy, comprehensiveness, and system running efficiency of sensitive information detection, providing strong protection for data security.

[0155] The innovation points of the present application mainly include: introducing a file format tampering prevention bypass detection mechanism to ensure that the detection is based on the real type of the file; using a DistilBERT-LSTM structure for sensitive information detection to improve the accuracy and efficiency of text sensitive information recognition; and innovatively introducing a cross-modal reasoning mechanism to further improve the accuracy and robustness of steganographic detection through cross-validation and reasoning of different modal information. These innovations enable the present application to have significant advantages in dealing with complex and variable data security threats, meeting the urgent needs of modern data security protection.

[0156] In summary, the present application provides a sensitive information detection method and system based on multi-modal and steganographic detection, which integrates multiple advanced technologies to build a comprehensive, efficient and accurate sensitive information detection solution, which is of great significance for protecting data security and preventing information leakage, and has broad application prospects and social value.

[0157] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A sensitive information detection method based on multimodal and steganalysis detection, characterized in that, include: Receive the file to be tested; Perform anti-file format tampering bypass detection, including: analyzing file header information, extracting binary structure features and performing format verification to determine the true file type; Based on the real type, perform sensitive information detection, including: after preprocessing the text, extract the text embedding vector using the DistilBERT model, capture the long-term dependent features of the text and focus on sensitive regions through bidirectional LSTM and Attention mechanism, and use a fully connected layer to determine whether the text contains sensitive information. Perform joint content and document steganalysis detection, including: extracting steganalysis features for text, document binary structure and image using Transformer, LSTM and CNN models respectively; constructing a multimodal neural network to integrate detection results from different modalities; and applying a cross-modal inference mechanism to cross-validate features from different modalities to improve detection accuracy. Output comprehensive detection results, including file format risk rating, distribution and category of sensitive information, and location and content of steganographic information; The aforementioned anti-file format tampering bypass detection specifically includes: File type identification based on magic numbers in the file header; Use the sliding window hash verification algorithm to extract and verify header sample information; The binary data structure of the file is analyzed to calculate byte frequency characteristics and data block entropy characteristics; The extracted feature vectors are compared with the feature library to determine the most likely true type of the file; Output file format tampering risk level assessment results.

2. The method according to claim 1, characterized in that, The similarity comparison between the feature vector and the feature library includes: Calculate the cosine similarity between the extracted feature vector and the standard vector in the feature library; Based on the similarity calculation results, determine the true type of the file; Record discrepancies between the declared file type and the actual file type, and generate a risk assessment report.

3. The method according to claim 1, characterized in that, The sensitive information detection specifically includes: Perform text cleaning operations to remove HTML tags and special characters; The system uses a multi-level sensitive word dictionary for matching, including basic sensitive words, synonyms, ambiguous words, and domain-specific sensitive words. Select the appropriate word segmentation tool based on the text language type, and perform word segmentation and word form restoration; Load the pre-trained DistilBERT model and extract context-aware text embedding vectors; A bidirectional LSTM network is constructed to process the embedded vectors, capturing long-term text dependencies through forward and backward passes; An attention mechanism is introduced to calculate attention weights, highlighting key areas of sensitive information. Use a fully connected layer and the Sigmoid function to determine whether the text contains sensitive information and generate a detailed report.

4. The method according to claim 1, characterized in that, The joint content and document steganography detection specifically includes: For the text portion, the Transformer model is used to analyze the document context and detect steganographic information hidden by subtle character changes; For the binary structure of a file, an LSTM model is used to analyze the sequence features of the binary data in the file and detect embedded data. For the image portion, a CNN model is used to analyze pixel-level changes in the image and identify hidden information; The detection results from different modalities are fused using a multimodal neural network for comprehensive analysis. A cross-modal reasoning mechanism is applied to improve detection accuracy and robustness, and output steganalysis detection results.

5. The method according to claim 4, characterized in that, The multimodal neural network includes: Design the Transformer encoder input layer for text modality; Design an LSTM input layer for binary structure modes; Design a CNN feature extraction layer for image modalities; Construct a feature fusion network based on an attention mechanism to automatically learn the correlations and weights between different modalities; The output is a fused multimodal feature representation, which is used for subsequent steganography detection and judgment.

6. The method according to claim 4, characterized in that, The cross-modal reasoning mechanism includes: Establish three sets of association networks: text-image, text-binary, and image-binary. Construct mapping relationships between different modal features; Cross-validation inference is performed based on detection results from different modalities and feature cues. To resolve conflicts in detection results between modalities and improve the confidence of steganalysis detection; The final conclusion on the detection of steganographic information is then formed.

7. The method according to claim 1, characterized in that, In the detection of sensitive information: The output of the bidirectional LSTM at processing time t is ,in and These are the hidden states of the forward and backward LSTMs, respectively; The attention mechanism calculates attention weights. ,in , to obtain the context vector ; The context vector c is processed through a fully connected layer to obtain the probability of sensitive information determination.

8. The method according to claim 1, characterized in that, It also includes the following steps: A comprehensive safety assessment report is generated based on the test results; Provide risk level assessments for discovered sensitive information and steganographic content; Files confirmed to contain threats should be marked and isolated. The detection results are fed back to the security management system for subsequent threat analysis and defense strategy updates.

9. A sensitive information detection system based on multimodal and steganalysis, implementing the method of any one of claims 1-8, characterized in that, include: The file format tampering bypass detection module is used to analyze file header information, extract binary structure features, and perform format verification to determine the true file type. The sensitive information detection module is used for text preprocessing. It uses the DistilBERT model to extract text embedding vectors, captures text features and focuses on sensitive areas through bidirectional LSTM and Attention mechanism, and uses fully connected layers to determine sensitive information. The joint content and document steganalysis module is used to perform steganalysis detection on text, document binary structure and image using Transformer, LSTM and CNN models respectively, and to build a multimodal neural network and cross-modal inference mechanism to integrate and analyze the detection results; The results output module is used to generate and output comprehensive detection results, including file format risk rating, distribution and category of sensitive information, and location and content of steganographic information.

Images