Apparatus and method for detecting images within spam

• US 10,095,922 B2
• Filed: 10/11/2012
• Issued: 10/09/2018
• Est. Priority Date: 01/11/2007
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Myers, John Gardiner, Yang, Yanyan
• Primary Examiner(s): Thirugnanam, Gandhi
• Application Number:
  US13/650,107
• Publication Number:
  US 20130039582A1
• Time in Patent Office: 2,189 Days
• Field of Search: 382305, 382306
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables

Abstract

A method is described that includes comparing a characteristic of an image to stored characteristics of spam images. The method also includes generating a signature of the present image. The method further includes comparing the signature of the present image to stored signatures of spam images. The method also includes determining the spam features corresponding to the stored signatures of spam images that match the signature of the present image.

Claims

1. A computer-implemented method for determining spam features of a present image, comprising:

determining whether a format of the present image is in a supported format of an image analyzer;

reading the present image by an image reader of the image analyzer when the format of the present image is determined to be in the supported format;

analyzing the present image by the image analyzer to determine whether the present image is corrupted, wherein the present image is determined to be corrupted when the image reader of the image analyzer determines that the format of the present image has been changed;

selecting between at least a first feature detection algorithm and a second feature detection algorithm based on the determination of whether the present image is corrupted;

when the present image is determined not to be corrupted, executing the first feature detection algorithm by the image analyzer to create a first signature to determine if the present image is a spam image, wherein the first feature detection algorithm comprises depixelating at least a first portion of the present image and processing the portion of the present image after the depixelation to create the first signature, wherein processing the portion of the present image comprises comparing a vector associated to the portion of the present image with a set of vectors of known spam images, and determining if the vector is within a range of similarity with one of the set of vectors; and

when the present image is determined to be corrupted, executing the second feature detection algorithm by the image analyzer to create a second signature to determine if the present image is a spam image, wherein the second feature detection algorithm comprises analyzing at least a second portion of the present image to create the second signature, and comparing the second signature to stored signatures of known spam images.

2. The computer-implemented method as in claim 1 wherein, if the first feature detection algorithm is executed and does not detect that the image is a spam image, then executing the second feature detection algorithm to validate the determination of the first feature detection algorithm.

3. The computer implemented method as in claim 2 wherein the second feature detection algorithm computes a precise signature of the second portion of the present image and wherein the first feature detection algorithm computes a signature of the first portion of the present image which is relatively less precise than the signature calculated by the second feature detection algorithm.

4. The computer-implemented method as in claim 1 wherein the first feature detection algorithm comprises creating the first signature for the present image after the depixelation and searching for a match for the first signature, and wherein the second feature detection algorithm comprises creating the second signature for the present image and searching for a match for the second signature.

5. The computer-implemented method as in claim 1 wherein the first portion of the present image is selected through cropping, wherein the cropping removes a percentage of at least one side of the present image.

6. The computer-implemented method as in claim 1 wherein the depixelation comprises blurring of the first portion of the present image until the present image reaches a certain size.

7. The computer-implemented method as in claim 4 wherein the first signature for the present image is the vector for the first portion of the present image.

8. A non-transitory machine-readable medium having machine-executable instructions stored thereon, which when executed by a computer processing system, causes the computer processing system to perform a method for determining spam features of a present image, the method comprising:

determining whether a format of the present image is in a supported format of an image analyzer;

reading the present image by an image reader of the image analyzer when the format of the present image is determined to be in the supported format;

analyzing the present image by the image analyzer to determine whether the present image is corrupted, wherein the present image is determined to be corrupted when the image reader of the image analyzer determines that the format of the present image has been changed;

selecting between at least a first feature detection algorithm and a second feature detection algorithm based on the determination of whether the present image is corrupted;

when the present image is determined not to be corrupted, executing the first feature detection algorithm by the image analyzer to create a first signature to determine if the present image is a spam image, wherein the first feature detection algorithm comprises depixelating at least a first portion of the present image and processing the portion of the present image after the depixelation to create the first signature, wherein processing the portion of the present image comprises comparing a vector associated to the portion of the present image with a set of vectors of known spam images, and determining if the vector is within a range of similarity with one of the set of vectors; and

when the present image is determined to be corrupted, executing the second feature detection algorithm by the image analyzer to create a second signature to determine if the present image is a spam image, wherein the second feature detection algorithm comprises analyzing at least a second portion of the present image to create the second signature, and comparing the second signature to stored signatures of known spam images.