Context-aware steganography detection at cloud networks

A data loss prevention (DLP) method to prevent data exfiltration across a plurality of tenants in a cloud network, the DLP method comprises:

• intercepting network traffic of an end-user device of a plurality of end-user devices at an application layer of the cloud network via a DLP server, wherein the DLP server functions as a middleware and is operable to:
• retrieve a plurality of images from the network traffic,
• extract a plurality of features from an image of the plurality of images, wherein the plurality of features comprises one or more of a pixel color chi-squared, an image type, and an image entropy,
• infer from the plurality of features, via a machine learning (ML) engine, a steganographic content in the image,
• compute a risk score for the end-user device based on the steganographic content and compare the risk score against a primary threshold,
• increment a risk count when the risk score exceeds the primary threshold and analyze a contextual information of the end-user device, and
• based on the contextual information, compare the risk count against a secondary threshold and generate an alert based on a plurality of policies when the risk count exceeds the secondary threshold.

A computer-readable medium having computer-executable instructions embodied thereon that, when executed by one or more processors, facilitates a data loss prevention (DLP) method to prevent data exfiltration across a plurality of tenants in a cloud network, the DLP method comprises:

• intercepting network traffic of an end-user device of a plurality of end-user devices at an application layer;
• retrieving a plurality of images from the network traffic;
• extracting a plurality of features from the plurality of images, wherein the plurality of features comprises one or more of a pixel color chi-squared, an image type, and an image entropy;
• inferring from the plurality of features, via a machine learning (ML) engine, a steganographic content in an image of the plurality of images;
• computing a risk score for the end-user device based on the steganographic content and comparing the risk score against a primary threshold;
• incrementing a risk count when the risk score exceeds the primary threshold;
• and
• based on a contextual information of the end-user device from the application layer, comparing the risk count against a secondary threshold and generating an alert based on a plurality of policies when the risk count exceeds the secondary threshold.