Information Hiding in the DICOM Message Service and Upper Layer Service with Entropy-Based Detection

Abstract

The DICOM (Digital Imaging and COmmunication in Medicine) standard provides a framework for a diagnostically-accurate representation, processing, transfer, storage and display of medical imaging data. Information hiding in DICOM is currently limited to the application of digital media steganography and watermarking techniques on the media parts of DICOM files, as well as text steganographic techniques for embedding information in metadata of DICOM files. To improve the overall security of the DICOM standard, we investigate its susceptibility to network steganographic techniques. To this aim, we develop several network covert channels that can be created by using a specific transport mechanism – the DICOM Message Service and Upper Layer Service. The bandwidth, undetectability and robustness of the proposed covert channels are evaluated, and potential countermeasures are suggested. Moreover, a detection mechanism leveraging entropy-based metrics is introduced and its performance has been assessed.

Cybersecurity and Medical Imaging: A Simulation-Based Approach to DICOM Communication

“…Mantri et al [37] conducted a comparative study of DICOM API libraries, while NIST [38] identified software and managed risks within the PACS ecosystem. Mileva et al [39] introduced covert channels for DICOM transport mechanisms, offering possibilities for covert communications, data exfiltration, and privacy leaking attacks.…”

“…In this research, Pydicom [46] was used as a tool to read DICOM files and send them to the Application Entity (AE). The AE supports Presentation Contexts, which consist of SOP Classes and Transfer Syntaxes [39,42,46]. The integration as presented in Figure 1 focuses on the integration between the AE and the PACS server.…”