Abstract: A plurality of containers related to one or more containerized applications are managed by monitoring an execution of the one or more containers; determining that a given one of the one or more containers exhibits anomalous behavior; and in response to the determining, adjusting a retention time of the given container, wherein the retention time of the given container determines when the given container is one or more of terminated and changes role to a honeypot container. The anomalous behavior comprises, for example, the given container exhibiting behavior that is different than a learned baseline model of the given container or including program code consistent with malicious activity. An alert notification of the anomalous behavior is optionally generated. The retention time of the given container can be adjusted for example, to an interval between deployment of the given container and the time the anomalous behavior is detected.

Abstract: An information handling system improves removal of steganography data embedded in a graphics file by processing graphics files stored in a file system or transmitted through a network by processing the graphics files in a steganalyzer. The steganalyzer converts the body segment of the graphics file into binary code, and then compresses the binary code into a graphics file. This process results in the removal of any potential malicious code. The body segment location can be determined by parsing the portable network graphics file to determine a location of a pre-fix graphics file signature and a post-fix graphics file signature, with the graphics files signatures being specific to a particular type of graphics file.

Abstract: Techniques are provided for detecting malicious software code embedded in image files, using machine learning. One method comprises obtaining metadata for an image file; applying the obtained metadata to at least one machine learning technique to classify the image file into at least one of a plurality of predefined classes, wherein the plurality of predefined classes comprises at least one malicious file class; and determining whether the image file comprises malicious software code based on the classification. The machine learning technique is trained using image files classified into at least one of the plurality of predefined classes. The machine learning technique employs a deep neural network and/or a convolutional neural network to classify the image file into the at least one predefined class.

Abstract: The life cycle of one or more containers related to one or more containerized applications is managed by determining that a predefined retention time for a first container of the plurality of containers has elapsed; in response to the determining, performing the following honeypot container creation steps: suspending new session traffic to the first container; maintaining the first container as a honeypot container; and identifying communications sent to the honeypot container as an anomalous communication. Alert notifications are optionally generated for the anomalous communication.

Abstract: An information handling system improves detection of steganography data embedded in a portable network graphics file by parsing the portable network graphics file to determine a location of a portable network graphics signature in the portable network graphics file, and determining whether there is data embedded in the portable network graphics file before the portable network graphics signature. The embedded data may then be removed from the portable network graphics file.

Abstract: An information handling system improves detection of steganography data embedded in a graphics file by parsing the portable network graphics file to determine a location of a graphics file signature in the graphics file, and determining whether there is data embedded in the graphics file before the graphics signature. The embedded data may then be removed from the graphics file.