A lossless steganography method based on process hook

Abstract

This invention discloses a lossless steganography method based on process hooks, comprising: analyzing nodes of attack images on social media platforms and constructing an image processing link library; identifying and locating lossy functions that cause information distortion based on syntax-semantic joint features and dynamic taint tracking technology; and bypassing lossy functions using process hooks to ensure lossless transmission of secret information. Experiments show that this invention is universal, requires no modification to existing steganography algorithms, and achieves lossless extraction of secret information in a real social ecosystem for the first time, significantly enhancing the reliability of covert communication in complex adversarial environments. This invention achieves lossless steganography by bypassing lossy attacks on social media platforms through process hooks, breaking the constraints between embedding capacity, security, and robustness, allowing steganography technology to focus on simultaneously improving security and embedding capacity, providing a universal and efficient solution for achieving lossless steganography.

Description

Technical Field

[0001] This invention relates to the field of image processing technology, and in particular to a lossless steganography method based on process hooks. Background Technology

[0002] In today's information age, the internet, satellite communications, social media, and other technologies have become deeply integrated into social life. They not only provide the public with unprecedented channels for information access and dissemination but also make everyone a potential node in the information network. For example, in a conflict, while systems like Starlink ensure the free flow of information, their satellite uplinks could themselves be used for location analysis, thus exposing users to certain privacy risks. Against this backdrop, we face a crucial question: how can we securely achieve the covert transmission of information in an open network environment?

[0003] When the content and metadata of encrypted communications may expose user information, we need to explore more covert communication strategies to hide information within everyday data, enabling its invisible circulation through public channels. Image steganography, as a technique for hiding information within images, provides a feasible path for this. This technique utilizes human vision and the statistical redundancy of digital media to hide secret information within public images and transmit it over open networks. The carrier image refers to the original image used to hide the information, while the steganographic image is the image containing the hidden information. Steganography not only hides the content of communication but also conceals the "secret communication" itself, becoming an effective means of transmitting private information in public environments.

[0004] For example, a photo documenting daily life is uploaded to a social media platform, seemingly just a normal sharing activity; however, for the recipient, this seemingly ordinary image may conceal important information. Without a separate encrypted channel or unusual communication traffic, the image spreads only through the conventional path of "mobile network → platform content distribution network → user interaction," allowing the encrypted image to blend into the daily deluge of hundreds of millions of images, making it difficult to identify and track.

[0005] However, to optimize bandwidth and user experience, social media platforms often compress, scale, or add watermarks to uploaded images. These operations often damage images containing embedded secret information, leading to information extraction failures and severely hindering the practical application of steganography. This necessitates that steganography algorithms possess extremely strong robustness, capable of resisting various unintentional or malicious processing. To address these challenges, researchers have proposed robust steganography techniques, aiming to design information hiding schemes that can resist channel attacks. Based on different information hiding mechanisms, existing robust steganography methods can be divided into three categories: modification-based, mapping-based, and generative. Modification-based robust image steganography methods embed information by adjusting robust coefficients in the image transform domain. Early research focused on robustness against signal processing operations such as JPEG compression, but they are insufficient against mixed attacks such as compression and scaling. Mapping-based robust image steganography methods achieve information hiding by establishing a stable mapping relationship between image features and secret information. While improving resistance to geometric deformation, they are often limited by the trade-off between the stability of feature extraction and the embedding capacity. In recent years, generative image robust steganography methods have gradually become a research hotspot. These methods primarily utilize generative models such as generative adversarial networks, diffusion models, variational autoencoders, and flow models to directly embed robust information during the image generation stage, demonstrating potential to counter complex attacks. Despite the continuous development of robust steganography techniques, the core challenge remains balancing capacity, robustness, and security. Compared to near-perfect steganography results in lossless channels, steganography systems in lossy channels often struggle to simultaneously achieve high embedding capacity, strong robustness, and high security, resulting in significant efficiency and practicality bottlenecks in practical deployments.

[0006] Most existing research focuses on finding robust regions or features in images and embedding secret information within them to achieve robust steganography. However, these methods often fail to ensure the complete extraction of secret information when faced with complex and diverse hybrid attacks on real social media platforms, and therefore are not truly robust steganography solutions. Summary of the Invention

[0007] This invention addresses the problem that existing robust steganography schemes are often not truly robust against hybrid attacks on social media platforms, failing to guarantee error-free transmission of secret bits. It proposes a lossless steganography method based on process hooks (HookSteg), a general and perfectly robust solution that provides truly lossless recovery capabilities for existing steganography methods that fail in social network environments. This invention cleverly bypasses lossy functions that attack secret images by modifying the client's image processing logic through runtime hooks, thereby achieving lossless transmission of secret information.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] The first aspect of this invention proposes a lossless steganography method based on process hooks, comprising:

[0010] Step 1: Analyze the nodes of attack images on social media platforms and build an image processing link library;

[0011] Step 2: Based on syntax-semantic joint features and dynamic taint tracking technology, identify and locate lossy functions that cause information distortion;

[0012] Step 3: Use process hooks to bypass lossy functions and ensure lossless transmission of secret information.

[0013] Further, step 1 includes:

[0014] Building an image processing library using a man-in-the-middle attack:

[0015] The client initiates a connection request to the server;

[0016] The man-in-the-middle intercepts the connection request, forges a response to mislead the client into believing that it has been connected to the server, and at the same time, the man-in-the-middle initiates a connection to the server to establish a link;

[0017] The client processes the original image to generate a processed image. and send it to the server;

[0018] Intercepted by middleman It stores and forwards it to the server to maintain communication;

[0019] Download the final image from the platform. ,Compare and The pixel matrix, if This indicates that only the client processes the data, and a lossless channel can be established; if If so, it means that the server is involved in the processing and a lossless channel cannot be established;

[0020] The decision-making mechanism will be added to the image processing library.

[0021] Furthermore, step 1 also includes:

[0022] When man-in-the-middle attacks are not feasible, use eBPF to capture local image data on the client side:

[0023] Write an eBPF program, load it into the kernel, and monitor the network communication of the client process;

[0024] The program filters data packets according to rules, capturing only traffic from the client process to the server process;

[0025] When the client process sends image data The program extracts image data blocks from the network buffer and reassembles them into a complete image. ;

[0026] Will Write to the storage medium for subsequent comparison;

[0027] By comparison With downloaded images The pixel matrix is ​​used to determine whether the processing mechanism involves the server side;

[0028] The decision-making mechanism will be added to the image processing library.

[0029] Further, step 2 includes:

[0030] The binary application is reverse-engineered into assembly language, and then further converted into a high-level language to obtain high-level statements;

[0031] Based on semantic features, feature statements are selected from the advanced statements;

[0032] Based on grammatical features, suspicious statements are filtered out from the featured statements;

[0033] Functions containing suspicious statements are marked as suspicious functions. By extracting suspicious functions, lossy functions that cause information distortion can be identified and located.

[0034] Furthermore, identifying and locating lossy functions that cause information distortion includes:

[0035] This approach combines dynamic triggering with call stack backtracking, integrating dynamic taint tracing techniques and suspicious function source tracing to analyze the API call sequence during image processing.

[0036] When the application performs an image upload operation, the interception operation implemented through hook technology targets the first suspicious statement in the set. The function corresponding to each statement is monitored. When a function is triggered, its input parameters, return value, and call stack are recorded. The call stack takes the top function as the function that directly operates on the image, and the other functions are the downstream functions in the call path.

[0037] During the call stack backtracking phase, starting from the function at the top of the stack, a pre-defined hooking strategy is applied sequentially to determine if the attack can be bypassed without causing program exceptions. If the function at the top of the stack cannot be bypassed, the same judgment is performed on downstream functions until the first function that can successfully bypass the image processing attack is found. , This is the lossy function.

[0038] Furthermore, the preset hooking strategy includes modifying the image processing logic and modifying the image uploading logic.

[0039] Further, step 3 includes:

[0040] The sender inputs the secret information and carrier data into a specified steganography algorithm to obtain the steganographic image;

[0041] Based on the obtained lossy function, the image processing flow is intercepted and modified using process hooking technology, and the encrypted image is uploaded to the social platform's server in a zero-copy manner.

[0042] The receiver obtains the coded image by searching for the sender's image on a social media platform and then uses the corresponding steganography method to fully extract the secret information sent by the sender.

[0043] Furthermore, step 3 also includes:

[0044] The system performs a pre-attack on the encrypted image to test the extraction accuracy before and after the attack. If the extraction accuracy decreases, it uses a process hook to bypass the lossy function; if the accuracy improves, it executes the social application's image processing flow normally when transmitting the encrypted image.

[0045] A second aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the aforementioned lossless steganography method based on process hooks.

[0046] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the aforementioned lossless steganography method based on process hooks.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] This invention cleverly bypasses lossy functions that attack encrypted images by modifying the client's image processing logic through runtime hooks, thereby achieving lossless transmission of secret information. The main contributions of this invention are reflected in the following five aspects:

[0049] 1) Perfect robustness: The proposed method is designed for lossy channels and can guarantee the complete extraction of embedded information under various channel attacks, with an average accuracy improvement of 36.63% compared to existing methods;

[0050] 2) Highly efficient attack localization: By using a lossy function capture method, attack code can be quickly identified from a large number of program instructions, eliminating 94.34% of non-image processing statements;

[0051] 3) Fast processing speed: This method significantly improves the transmission speed of secret information by bypassing the conventional image processing link, reducing the processing time for secret images to less than 1 millisecond;

[0052] 4) High versatility: It proposes a universal and perfectly robust steganography scheme that does not require modification of existing steganography methods, providing a truly lossless solution for steganography methods that fail in social network scenarios;

[0053] 5) Breaking existing constraints: It breaks the constraints between embedding capacity, security and robustness, enabling steganography technology to focus on simultaneously improving security and embedding capacity.

[0054] Real-world testing on platforms with tens of millions of daily active users, such as Youku and Kutumb, demonstrates that HookSteg is versatile and requires no modification to existing steganography algorithms. For the first time, it achieves lossless extraction of secret information in a real social ecosystem (average extraction accuracy improved by 44.61%). Furthermore, its lossy function localization efficiency is 94.34% higher than traditional manual reverse engineering methods, significantly enhancing the reliability of covert communication in complex adversarial environments. Attached Figure Description

[0055] Figure 1 One of the flowcharts for a lossless steganography method based on process hooks provided in this embodiment of the invention;

[0056] Figure 2 The differences between the existing methods provided in the embodiments of the present invention and HookSteg;

[0057] Figure 3 The market share of the mobile device operating system provided in the embodiments of the present invention;

[0058] Figure 4 A second flowchart of a lossless steganography method based on process hooks provided in this embodiment of the invention;

[0059] Figure 5 This is a schematic diagram illustrating the verification of the image processing mechanism provided in an embodiment of the present invention.

[0060] Figure 6 Example diagrams of statement formats provided for embodiments of the present invention;

[0061] Figure 7 This is a schematic diagram illustrating the bypassing of lossy functions provided in an embodiment of the present invention;

[0062] Figure 8 The lossy function localization efficiency provided in the embodiments of the present invention. Detailed Implementation

[0063] For ease of understanding, the following explanations are provided for some of the terms used in the specific embodiments of this invention:

[0064] Extended Berkeley Packet Filter (eBPF): This method can copy data packets to user space in real time without modifying the kernel source code, hooking the network stack, system calls, or event points such as kprobe with near-native performance. This approach is legal, transparent, and application-layer unaware, but requires the target device to have Linux eBPF enabled and the technical skill to write and load eBPF programs.

[0065] Man-in-the-middle (MITM) attacks exploit network protocol vulnerabilities or configuration weaknesses to insert a relay between communicating parties, forcing traffic to pass through a designated node and thus intercepting, recording, or modifying data at a relatively low computational cost. MITM attacks are simple to deploy but are easily blocked by proxy detection, certificate pinning, and other protective mechanisms.

[0066] A process hook is a technique used in computer programming to intercept and modify the execution flow of a program. It allows developers to monitor specific functions, methods, or system calls within a program and inject custom processing logic without altering the original code.

[0067] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0068] like Figure 1 As shown, a lossless steganography (HookSteg) method based on process hooks includes:

[0069] S101: Analyze the nodes that attack images on social media platforms and build an image processing link library;

[0070] S102: Based on syntax-semantic joint features and dynamic taint tracking technology, identify and locate lossy functions that cause information distortion;

[0071] S103: By using process hooks to bypass lossy functions and ensure lossless transmission of secret information.

[0072] This invention proposes a lossless steganography framework based on runtime hooks. As a general and perfectly robust solution, it provides truly lossless recovery capabilities for existing steganography methods that fail in social network environments. The differences from existing methods are as follows: Figure 2 As shown, this invention cleverly bypasses lossy functions that attack confidential images by modifying the client's image processing logic through runtime hooks, thereby achieving lossless transmission of secret information.

[0073] Figure 3 This shows the market share of mobile device operating systems, with data from StatCounter, a leading national traffic statistics and analysis service provider. Figure 3This indicates that Android's market share has remained above 70.48% for the past three years, demonstrating its dominant position in the market. For ease of explanation, this invention discusses and experimentally verifies HookSteg on the widely used Android system.

[0074] Image processing mechanisms in modern operating systems like Android permeate the entire process of data storage, processing, and transmission. At the storage level, images are saved as binary files on local storage or in the cloud; at the processing level, the system uses graphics processing libraries to perform operations such as decoding, compression, and rendering of images; at the transmission level, image data is encapsulated via network protocols and exchanged between the client and server.

[0075] The threat model considered in this invention involves two main participants: the sender and the receiver. The attack scenario can be further refined into the following technical implementation path: The sender operates a rooted mobile device, deploys a Hook framework on this device to dynamically intercept the process memory data of social applications, and simultaneously installs man-in-the-middle attack tools such as Requable or Charles to decrypt HTTPS traffic by forging CA certificates, completely capturing API request or response data packets between the client and server, including the binary stream of images. The receiver then legitimately logs into the social platform account credentials provided by the sender using a regular mobile device or PC browser to download the encrypted image.

[0076] To achieve lossless transmission of secret information, we cleverly circumvent potential interference from applications on the encrypted image by hooking image processing functions, proposing a perfectly robust, efficient, and universal lossless steganography method. This method provides a truly lossless solution for all steganography methods that fail in social network scenarios without modifying existing methods.

[0077] The specific process of the HookSteg method is as follows: Figure 4 As shown, it consists of two parts: preprocessing and covert communication. The preprocessing process has three steps: constructing an image processing link library, extracting suspicious functions, and locating lossy functions. The covert communication process has two steps: sending secret information and extracting secret information.

[0078] The core objective of the preprocessing stage is to accurately locate image processing functions to effectively prevent attacks on encrypted images. This process first constructs an image processing library to determine whether encrypted images are processed only on the application's client side. If the encrypted image is indeed processed only on the client side, relevant image processing instructions are retrieved using syntactic-semantic joint features. Then, based on the retrieved instructions, suspicious statements are extracted using image processing features. Next, dynamic taint tracking technology is used to hook the suspected function to be verified on the client side, sending the encrypted image to trigger the function. Finally, an attempt is made to modify the triggered function. If it successfully prevents the function from attacking the encrypted image, it is determined to be a lossy function. If the function cannot be modified, the next function is retrieved from the function call stack for testing, and the above process is repeated until a lossy function is successfully identified.

[0079] In covert communication, the core task for the sender is to ensure that the information carried by the coded image remains intact after processing by the social media platform. Here, the lossy function identified during the preprocessing stage plays a crucial role. The sender uses kernel-level hooking techniques to intercept calls to the target lossy function, bypassing it with zero-copy processing. The core logic is to bypass the lossy function when the image to be processed is detected as coded. For the receiver, the process is relatively straightforward, requiring no complex software configuration. The receiver simply accesses the sender's public account on the social media platform, downloads or views the coded image posted by the sender, just like any other user. Then, the receiver uses a pre-agreed information extraction algorithm to analyze the acquired image, accurately and completely reconstructing the sender's hidden coded information.

[0080] 1. Building an image processing library

[0081] The nodes and methods of image processing vary significantly across different applications. Some platforms perform image processing only on the client-side node, while others perform processing on both the client and server-side nodes. The processing operations also differ, including compression, scaling, watermarking, and other forms.

[0082] To verify whether a specific application can establish a lossless HookSteg channel, we need to analyze the processing nodes of lossy functions and construct an image processing link library. HookSteg employs a dual verification method, primarily using Man-in-the-Middle (MitM) attacks and secondarily using eBPF technology. The overall process is as follows: Figure 5 As shown.

[0083] Let the client be The server is The middleman The original communication link is:

[0084] (1)

[0085] After a man-in-the-middle attack, it becomes:

[0086] (2)

[0087] The process of building an image processing library using a man-in-the-middle attack involves the following six steps:

[0088] ① Connection establishment request: Towards Initiate a connection request .

[0089] ②Middleman hijacking: Intercepted Forged response make Mistakenly believed to be connected ,at the same time Towards Initiate connection ,Establish link.

[0090] ③ Image data upload: For the original image Processing (such as compression, scaling, etc.) to generate the processed image. and send it to :

[0091] (3)

[0092] ④ Image capture and storage: Intercepted It can be stored as and forwarded to To maintain communication:

[0093] (4)

[0094] ⑤ Processing mechanism determination: Download the final image from the platform. ,Compare and The pixel matrix. If This indicates that only the client processes the code, and a lossless HookSteg channel can be established; if If the result is negative, it means that the server is involved in the processing and cannot establish a lossless channel for HookSteg.

[0095] ⑥ Add to image processing library: Add the decision processing mechanism to the image processing library.

[0096] When a man-in-the-middle attack is not feasible, eBPF is used to capture local image data on the client side. Let the client process be... The server process is .

[0097] ① eBPF program loading: Writing eBPF programs Loaded into the kernel, monitored Network communication.

[0098] ② Data packet filtering: Filter packets based on rules (such as target port, protocol type) to capture only... Traffic.

[0099] ③ Image data extraction: When Send image data hour Extract image data blocks from the network buffer. Reconstructed into a complete image .

[0100] ④ Data storage: Write it to the storage medium for later comparison.

[0101] ⑤ Processing mechanism judgment: also through comparison With downloaded images The pixel matrix is ​​used to determine whether the processing mechanism involves the server side.

[0102] ⑥ Add to image processing library: Add the decision processing mechanism to the image processing library.

[0103] By performing the above steps on multiple platforms, a multi-platform image processing library can eventually be built.

[0104] 2. Extract suspicious functions

[0105] While traditional methods of hooking lossy functions through static analysis and dynamic debugging are effective, they also have some significant drawbacks. They require manual analysis of the entire codebase, especially for complex, large applications where the decompiled code may be difficult to understand and may contain obfuscation or encryption, greatly increasing the difficulty of analysis. To quickly locate lossy functions, we propose a lossy function localization method based on joint syntactic-semantic features. This method consists of two stages: extracting suspicious functions and locating the lossy function.

[0106] In the stage of extracting suspicious statements, we established a set of heuristic rules to filter statements based on joint syntactic and semantic features. To facilitate the description of the relevant methods, we first define three types of statements: statements obtained by reverse engineering the application and then further converted into a high-level language, which are called high-level statements; statements selected from the complete set of decompiled high-level statements based on semantic features, which are called feature statements; and statements further selected from the complete set of feature statements based on syntactic features, which are called suspicious statements.

[0107] This stage can be divided into two sub-steps: Search for High-Level Statements (SHS) and Extract Suspicious Statements (ESS), which can be represented as follows:

[0108] (5)

[0109] (6)

[0110] in, For advanced statement collection, For a set of characteristic statements, The set of suspicious statements, and the elements in the set are respectively represented as , , . It involves initial screening based on the semantics of image processing. Is Further filtering of the collection containing the target statement, Represents the set of semantic features in image processing. This represents a set of syntactic features for image processing, whose elements are respectively represented by... and To express.

[0111] In the high-level statement retrieval stage, the binary application needs to be reverse-engineered into assembly language, and then further converted into a high-level language. Based on the semantic feature codes of image processing (as shown in Table 1), this process can be formally represented as:

[0112]

[0113] Table 1 Common semantic features in image processing

[0114]

[0115] To further narrow down the selection, the statements are segmented based on syntactic features, as shown in the segmentation diagram below. Figure 6 As shown.

[0116] Using image type set For the set of characteristic statements Further filtering will add these functions to the list of suspicious statements. It can be formally represented as:

[0117] (8)

[0118] Functions containing suspicious statements are marked as "suspicious functions." Extracting these functions can provide support for locating lossy functions.

[0119] 3. Locating lossy functions

[0120] To locate lossy functions, we employ a combination of dynamic triggering and call stack backtracking, integrating dynamic taint tracing techniques with the API call sequence during image processing to identify the source of suspicious functions. This process aims to intercept suspicious functions using hooking techniques, analyze their execution context, and thus identify target methods capable of effectively bypassing image processing attacks.

[0121] Hooking technology performs interception operations using... This indicates that when the application performs an image upload operation, it uses... right The Middle The function corresponding to each statement Monitor it. When a certain function... When triggered (this function is called the triggering function), its input parameters, return value, and call stack are recorded. The call stack Top of stack Functions that directly manipulate images, the rest. This is for calling downstream functions in the call path.

[0122] Table 2 Hooking strategies to bypass attacks on encrypted images

[0123]

[0124] To bypass attacks targeting encrypted images, we intervened in the triggering function or functions in its call stack according to the hooking strategies listed in Table 2. Specifically, hooking of the image processing process can be achieved by modifying the image processing logic (such as replacing method parameters, constructing return objects, or intercepting method execution) and modifying the image upload logic (such as replacing the uploaded image path).

[0125] During the call stack backtracking phase, for the first... A suspicious function The corresponding call stack, we start from the function at the top of the stack. Initially, the hooking strategy is tried sequentially to determine if the attack can be bypassed without causing program errors. If it cannot be bypassed, then continue with... ...perform the same checks until the first function that can successfully bypass the image processing attack is found. This process can be formally represented as:

[0126] (9)

[0127] here It is a temporary variable of type integer. This is the original, unprocessed image (without any lossy processing). For the process The processed image. This refers to the lossy function that needs to be located.

[0128] A diagram illustrating lossy function bypass is shown below. Figure 7 As shown, Figure 7 The lossy function in the code is "processImage".

[0129] The fast localization method for lossy functions can be described by Algorithm 1. The input of this algorithm is the target app, and the output is... , Indicates obtaining The function it belongs to, getStack( This indicates obtaining the call stack corresponding to the triggering function. Hook operation Can be defined as

[0130] (10)

[0131] here This is a hooking strategy.

[0132]

[0133] In summary, this method systematically identifies and verifies image processing or uploading functions that can effectively protect confidential information through dynamic monitoring and stack structure analysis, thereby achieving accurate location and bypass of attack functions.

[0134] 4. Covert Communication Process

[0135] In the covert communication phase, the sender first transmits secret information. and carrier image Input the specified steganography algorithm Obtaining a encrypted image can be formally represented as:

[0136] (11)

[0137] in For modification-based steganography, it is the carrier image; for generative steganography, it is a randomly sampled latent vector. It is the key.

[0138] Subsequently, based on the obtained lossy function By intercepting and modifying the image processing flow through kernel-level hooking technology (specifically process hooking technology), the encrypted image is transferred in a zero-copy manner. The server that uploads to the social media platform can be formally represented as:

[0139] (12)

[0140] in, Indicates server, Upload( ) represents the image upload function.

[0141] However, not all steganographic images achieve higher extraction accuracy before an attack than after. In some cases, image processing may precisely correct certain distributional biases or minor errors that occurred during the training or generation of the steganography model, allowing the extractor to operate on data closer to the training conditions, thereby improving extraction accuracy. Therefore, an adaptive bypass strategy can be employed to process steganographic images as follows:

[0142] (13)

[0143] in, This indicates the extraction accuracy of the encrypted image after image processing. This indicates the extraction accuracy of the encrypted image before image processing. Specifically, the strategy first performs a pre-attack on the encrypted image to detect the extraction accuracy before and after the attack. If the extraction accuracy decreases, a bypass strategy is adopted; if the accuracy improves, the normal image processing flow of the social application is executed when transmitting the encrypted image.

[0144] Once a coded image is posted on a social network, the recipient can retrieve the coded image by searching for the sender's image on a specific social platform and use the corresponding steganography method to fully extract the secret information sent by the sender.

[0145] (14)

[0146] in, This indicates the extracted secret information.

[0147] It is worth noting and They may be equal or unequal, depending on the steganography algorithm. When not under attack, If the obtained encrypted image can be completely extracted, then ;otherwise This means that the HookSteg channel does not guarantee the complete extraction of secret information; it depends on whether the secret-carrying image generated by a specific algorithm can be completely extracted without being attacked.

[0148] To verify the effectiveness of the present invention, the following experiment was conducted:

[0149] 5. Experimental Results

[0150] In this section, we will verify the performance of HookSteg through experiments. This section mainly includes experiments on experimental setup, image processing mechanism verification, lossy function localization efficiency, robustness, and transmission efficiency.

[0151] 5.1 Experimental Setup

[0152] During the experiment, we used the OnePlus Ace2 as the real device and verified HookSteg in a real network environment. This device ran Android 13. To achieve in-depth testing and analysis of the framework, we used the Frida Hook framework in a Python environment, employed the Objection tool to monitor function execution in real time, and used Reqable as a network data analysis tool to accurately capture and analyze key information during network data interaction.

[0153] 5.2 Lossy Function Localization Efficiency

[0154] To verify the effectiveness of HookSteg in locating lossy functions, we conducted an experiment on applications that can be bypassed by hook attacks, including iQiyi, Toutiao, Youku Video, Baidu Maps, QQ Reading, Kutumb, and Hiferr. The experiment accurately identified lossy functions, and the total number of searches, rejections, inclusions, and efficiency improvements compared to manual analysis for each application are presented in the table below. Figure 8 (a)(b)(c) and (d).

[0155] The experimental results show that HookSteg's lossy function localization method demonstrates high efficiency in locating lossy functions, with an average efficiency improvement of 94.34%. This indicates that the method is significantly effective in reducing the number of unnecessary searches, thereby improving overall search efficiency. Furthermore, the applied lossy functions are all found in the filtered suspicious statements, demonstrating that the method effectively identifies lossy functions during the filtering process, ensuring the accuracy and reliability of the filtering results.

[0156] 5.3 Robustness Experiment

[0157] To verify the robustness of the modified steganography method, we selected steganographic images with the same attack quality factor on the target platform for experiments to evaluate robustness. The experimental results are shown in Table 3. The three columns in Table 3 represent the extraction accuracy of the original steganographic image, the extraction accuracy after transmission, and the change in extraction accuracy before and after transmission, respectively. When the extraction accuracy before and after transmission is non-negative, it indicates that the extraction accuracy has not decreased.

[0158] Table 3. Robustness experiments of modified steganography methods when the target platform is known.

[0159]

[0160] In Table 3, SCRIPT (K. Zeng, K. Chen, J. Zhang, W. Zhang, and N. Yu, “Towardsecure and robust steganography for black-box generated images,” IEEETransactions on Information Forensics and Security, vol. 19, pp. 3237–3250, Feb. 2024.), ROAST (K. Zeng, K. Chen, W. Zhang, and Y. Wang, “Upward robuststeganography based on overflow alleviation," IEEE Transactions onMultimedia, vol. 26, pp. 299–312, Apr. 2024.), JCRISBE (Z. Zhao, Q. Guan, H.Zhang, and X. Zhao, "Improving the robustness of adaptive steganographicalgorithms based on transport channel matching," IEEE Transactions onInformation Forensics and Security, vol. 14, no. 7, pp. 1843–1856, Jul. 2019.

[0161] Experimental data shows that the extraction accuracy of the encrypted image transmitted via a normal channel using the comparative method remains at only around 50%. This result is comparable to random guessing, failing to reliably extract the secret information, and significantly limiting the reliability and practicality of its steganography in real-world environments. When the target platform is known, both non-robust and robust steganography methods struggle to resist the mixed lossy processing of social media platforms. Furthermore, we found that some steganography methods are unsuitable for scenarios with specific quality factors. For example, when both the encrypted image and the platform attack have a quality factor of 100, the DMAS and ROAST methods cannot embed the secret information, while the JCRISBE method cannot even obtain experimental results. However, when transmitting the encrypted image via HookSteg on the target platform, the extraction accuracy of the secret information remains consistent with that of the unattacked original embedded image. Compared to transmission via a normal channel, the extraction accuracy is improved by an average of 44.61%, a significant improvement that fully demonstrates HookSteg's superior robustness, effectively resisting various interferences and ensuring stable extraction of the secret information.

[0162] This invention presents, for the first time, a lossless and robust steganography method. This method utilizes runtime hooks to prevent image compression, resampling, and other attacks from the source. Experimental results demonstrate that our method achieves truly efficient and robust steganography in real-world lossy social media environments. Furthermore, this method breaks down the constraints between embedding capacity, security, and robustness, allowing steganography techniques to focus on simultaneously improving both security and embedding capacity.

[0163] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A lossless steganography method based on process hooks, characterized in that, include: Step 1: Analyze the nodes of attack images on social media platforms and build an image processing link library; Step 2: Based on syntax-semantic joint features and dynamic taint tracking technology, identify and locate lossy functions that cause information distortion; Step 3: Use process hooks to bypass lossy functions and ensure lossless transmission of secret information.

2. The lossless steganography method based on process hooks according to claim 1, characterized in that, Step 1 includes: Building an image processing library using a man-in-the-middle attack: The client initiates a connection request to the server; The man-in-the-middle intercepts the connection request, forges a response to mislead the client into believing that it has been connected to the server, and at the same time, the man-in-the-middle initiates a connection to the server to establish a link; The client processes the original image to generate a processed image. and send it to the server; Intercepted by middleman It stores and forwards it to the server to maintain communication; Download the final image from the platform. ,Compare and The pixel matrix, if This indicates that only the client processes the data, and a lossless channel can be established; if If so, it means that the server is involved in the processing and a lossless channel cannot be established; The decision-making mechanism will be added to the image processing library.

3. The lossless steganography method based on process hooks according to claim 2, characterized in that, Step 1 further includes: When man-in-the-middle attacks are not feasible, use eBPF to capture local image data on the client side: Write an eBPF program, load it into the kernel, and monitor the network communication of the client process; The program filters data packets according to rules, capturing only traffic from the client process to the server process; When the client process sends image data The program extracts image data blocks from the network buffer and reassembles them into a complete image. ; Will Write to the storage medium for subsequent comparison; By comparison With downloaded images The pixel matrix is ​​used to determine whether the processing mechanism involves the server side; The decision-making mechanism will be added to the image processing library.

4. The lossless steganography method based on process hooks according to claim 1, characterized in that, Step 2 includes: The binary application is reverse-engineered into assembly language, and then further converted into a high-level language to obtain high-level statements; Based on semantic features, feature statements are selected from the advanced statements; Based on grammatical features, suspicious statements are filtered out from the featured statements; Functions containing suspicious statements are marked as suspicious functions. By extracting suspicious functions, lossy functions that cause information distortion can be identified and located.

5. The lossless steganography method based on process hooks according to claim 4, characterized in that, The process of extracting suspicious functions, identifying and locating lossy functions that cause information distortion includes: This approach combines dynamic triggering with call stack backtracking, integrating dynamic taint tracing techniques and suspicious function source tracing to analyze the API call sequence during image processing. When the application performs an image upload operation, the interception operation implemented through hook technology targets the first suspicious statement in the set. The function corresponding to each statement is monitored. When a function is triggered, its input parameters, return value, and call stack are recorded. The call stack takes the top function as the function that directly operates on the image, and the other functions are the downstream functions in the call path. During the call stack backtracking phase, starting from the function at the top of the stack, a pre-defined hooking strategy is applied sequentially to determine if the attack can be bypassed without causing program exceptions. If the function at the top of the stack cannot be bypassed, the same judgment is performed on downstream functions until the first function that can successfully bypass the image processing attack is found. , This is the lossy function.

6. The lossless steganography method based on process hooks according to claim 5, characterized in that, The preset hooking strategy includes modifying the image processing logic and modifying the image upload logic.

7. The lossless steganography method based on process hooks according to claim 1, characterized in that, Step 3 includes: The sender inputs the secret information and carrier data into a specified steganography algorithm to obtain the steganographic image; Based on the obtained lossy function, the image processing flow is intercepted and modified using process hooking technology, and the encrypted image is uploaded to the social platform's server in a zero-copy manner. The receiver obtains the coded image by searching for the sender's image on a social media platform and then uses the corresponding steganography method to fully extract the secret information sent by the sender.

8. The lossless steganography method based on process hooks according to claim 7, characterized in that, Step 3 also includes: The system performs a pre-attack on the encrypted image to test the extraction accuracy before and after the attack. If the extraction accuracy decreases, it uses a process hook to bypass the lossy function; if the accuracy improves, it executes the social application's image processing flow normally when transmitting the encrypted image.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements a lossless steganography method based on process hooks as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements a lossless steganography method based on process hooks as described in any one of claims 1 to 8.

Images