Steganographic Encoding Detection in PDF Files

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current data leak prevention solutions are inadequate in detecting and preventing data leaks in Portable Document Format (PDF) files that use null space coding steganographic techniques to conceal hidden information, as they primarily focus on metadata removal and do not effectively address hidden data within the document body.

Innovation Solution

A system and method that analyzes PDF files for the presence of steganographically encoded text strings by counting Unicode characters A0h and 20h, determining if the number of A0h characters exceeds a threshold, and if multiple text strings on a page meet this criterion, marking the file as encoded and sanitizing it by altering the width of A0h characters or removing them to prevent data leakage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DLP solutions remove sensitive information from metadata fields, then data security is improved, but steganographically encoded hidden information in the document body remains undetected

Engineering Contradiction:

Improvedata securityVSAvoiddetection of hidden information

Core Design Contradiction:

ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent segments the PDF file analysis into multiple components: metadata field inspection, document body text analysis, and steganographic pattern detection. By dividing the detection process into separate analytical stages, the system can identify hidden information encoded in the document body while maintaining security protocols for metadata removal.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary analysis of the document body structure before final security processing. It预先 identifies steganographic patterns by analyzing text string characteristics and encoding schemes, allowing the system to detect hidden information before it can be transmitted or processed further.

Inventive Principle:

Principle #10Preliminary action

2Loss of information

If PDF files are re-encoded to conceal hidden information using null space coding, then data leakage is prevented from metadata, but hidden information is embedded in the document body

Engineering Contradiction:

Improveprotection of sensitive informationVSAvoidhidden data in document body

Core Design Contradiction:

Loss of informationVSObject-generated harmful factors

Solution Approach 1:

The patent converts the harmful steganographic encoding technique into a detectable pattern by analyzing specific Unicode character sequences and text string structures. The null space coding method, while intended to hide information, creates identifiable patterns that the system detects and flags for further security processing.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Solution Approach 2:

The patent changes the 'visibility' of hidden information by detecting anomalies in text rendering and character encoding. It identifies steganographically encoded content by analyzing deviations from normal text patterns, effectively making the hidden information detectable through structural analysis rather than visual inspection.

Inventive Principle:

Principle #32Color changes

3Productivity

If DLP solutions focus on metadata removal, then processing speed is maintained, but detection capability against steganographic encoding is insufficient

Engineering Contradiction:

Improveprocessing efficiencyVSAvoiddetection accuracy of steganographic encoding

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent applies partial analysis to the document body by focusing on specific text strings and Unicode character patterns rather than analyzing every character. This selective approach maintains processing efficiency while achieving sufficient detection accuracy for steganographic encoding identification.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent replaces comprehensive manual inspection with automated pattern recognition algorithms that analyze Unicode character sequences and text string structures. This substitution of mechanical analysis with algorithmic detection maintains high processing speed while improving detection precision for steganographic encoding.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS10685171B2Steganographic encoding detection and remediation

Publication Date: 2020.06.16 MCAFEE LLC

AI summary

A steganographic coding detector (and method) analyzes one or more pages of a file. For each page containing text strings, the detector counts a number of A0h and 20h characters for the text string. For each text string for which the number of A0h characters is greater than a first threshold, the detector sets a flag to a first state, The first threshold is computed based on the number of 20h characters in that text string. For each text string for which the number of 20h characters is less than the first threshold, the detector sets the flag to a second state. Responsive to the number of text strings that have a flag at the first state being greater than a second threshold, the detector marks the file as being steganographically encoded.