Leaking Sensitive Financial Accounting Data in Plain Sight using Deep Autoencoder Neural Networks

TL;DR

This paper demonstrates how deep autoencoder neural networks can be exploited to covertly leak sensitive financial data embedded in ordinary images, highlighting a new security threat for organizations using ERP systems.

Contribution

It introduces a realistic threat model and a deep steganographic method using neural networks to hide sensitive accounting data in everyday images, which can evade detection.

Findings

Deep neural networks can effectively embed sensitive data in images.

The proposed steganographic technique remains undetected by current audit tools.

Experimental results on real-world datasets validate the method's feasibility.

Abstract

Nowadays, organizations collect vast quantities of sensitive information in `Enterprise Resource Planning' (ERP) systems, such as accounting relevant transactions, customer master data, or strategic sales price information. The leakage of such information poses a severe threat for companies as the number of incidents and the reputational damage to those experiencing them continue to increase. At the same time, discoveries in deep learning research revealed that machine learning models could be maliciously misused to create new attack vectors. Understanding the nature of such attacks becomes increasingly important for the (internal) audit and fraud examination practice. The creation of such an awareness holds in particular for the fraudulent data leakage using deep learning-based steganographic techniques that might remain undetected by state-of-the-art `Computer Assisted Audit Techniques' (CAATs). In this work, we introduce a real-world `threat model' designed to leak sensitive accounting data. In addition, we show that a deep steganographic process, constituted by three neural networks, can be trained to hide such data in unobtrusive `day-to-day' images. Finally, we provide qualitative and quantitative evaluations on two publicly available real-world payment datasets.