Graphics File Body Reconstruction for Steganographic Malware Removal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting and removing malicious code embedded in graphics files through steganography are ineffective, as they rely on cryptographic hashes that can be thwarted by variants with different hashes or malware that avoids detection by embedding itself in operating systems.
Innovation Solution
An information handling system parses graphics files to locate a body segment, converts it into binary code, and then back into a replacement segment using a lossless compression algorithm, effectively removing malicious code while maintaining the original image data, regardless of file extensions or metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cryptographic hash methods are used to detect malicious code in graphics files, then detection speed is improved, but detection reliability deteriorates because variants with different hashes or malware that avoids detection cannot be identified
Solution Approach 1:
The patent extracts the body segment from the graphics file by identifying and removing the signature bytes (pre-fix and post-fix signatures). This extraction approach allows direct analysis of the actual image data without relying on cryptographic hashes, enabling detection of malicious code embedded in graphics files while maintaining detection speed.
Solution Approach 2:
Instead of trying to detect malicious code by analyzing hashes or metadata, the patent inverts the approach by converting the body segment to binary code and back to graphics format. This inversion process naturally reveals embedded malicious code while preserving legitimate image data, solving the reliability problem.
2Reliability
If binary code conversion and lossless compression are applied to remove steganography data, then malicious code removal effectiveness is improved, but processing complexity increases
Solution Approach 1:
The patent creates a binary code representation (copy) of the body segment, processes it, and converts it back to graphics format. This copying approach allows the system to work with a transformed version of the data that makes malicious code visible while maintaining the original image quality through lossless compression.
Solution Approach 2:
The patent changes the parameter representation of the image data from graphics format to binary code and back. This parameter transformation causes embedded malicious code to manifest differently, enabling its detection and removal while preserving legitimate image data through the reversible nature of the conversion process.
3Measurement precision
If graphics files are scanned by converting body segments to binary code and back, then steganography detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent segments the graphics file into distinct components: pre-fix signature, body segment, and post-fix signature. By focusing processing only on the body segment and using efficient binary conversion algorithms, the system achieves high detection accuracy while minimizing processing time for the actual malicious code detection task.
Data Source
AI summary
An information handling system improves removal of steganography data embedded in a graphics file by processing graphics files stored in a file system or transmitted through a network by processing the graphics files in a steganalyzer. The steganalyzer converts the body segment of the graphics file into binary code, and then compresses the binary code into a graphics file. This process results in the removal of any potential malicious code. The body segment location can be determined by parsing the portable network graphics file to determine a location of a pre-fix graphics file signature and a post-fix graphics file signature, with the graphics files signatures being specific to a particular type of graphics file.