# Open Image Content Disarm And Reconstruction

arXiv: https://arxiv.org/abs/2307.14057 · HTML: https://mlsanity.com/paper/2307.14057/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 2 of its 39 references that are in the map.
- First posted on arXiv 26 Jul 2023.

## Builds on (most cited first, 2 of 2)

- [Improving Robustness of ML Classifiers against Realizable Evasion Attacks Using Conserved Features](https://mlsanity.com/paper/1708.08327/) (2017)
- [Stegomalware: A Systematic Survey of MalwareHiding and Detection in Images, Machine LearningModels and Research Challenges](https://mlsanity.com/paper/2110.02504/) (2021)

## Built on by (most cited first, 2 of 2)

- [Zero-Trust Artificial Intelligence Model Security Based on Moving Target Defense and Content Disarm and Reconstruction](https://mlsanity.com/paper/2503.01758/) (2025)
- [Training-Free Color-Aware Adversarial Diffusion Sanitization for Diffusion Stegomalware Defense at Security Gateways](https://mlsanity.com/paper/2512.24499/) (2025)

## Abstract (arXiv)

With the advance in malware technology, attackers create new ways to hide their malicious code from antivirus services. One way to obfuscate an attack is to use common files as cover to hide the malicious scripts, so the malware will look like a legitimate file. Although cutting-edge Artificial Intelligence and content signature exist, evasive malware successfully bypasses next-generation malware detection using advanced methods like steganography. Some of the files commonly used to hide malware are image files (e.g., JPEG). In addition, some malware use steganography to hide malicious scripts or sensitive data in images. Steganography in images is difficult to detect even with specialized tools. Image-based attacks try to attack the user's device using malicious payloads or utilize image steganography to hide sensitive data inside legitimate images and leak it outside the user's device. Therefore in this paper, we present a novel Image Content Disarm and Reconstruction (ICDR). Our ICDR system removes potential malware, with a zero trust approach, while maintaining high image quality and file usability. By extracting the image data, removing it from the rest of the file, and manipulating the image pixels, it is possible to disable or remove the hidden malware inside the file.