Detection of image spam

• US 20080127340A1
• Filed: 12/11/2006
• Published: 05/29/2008
• Est. Priority Date: 11/03/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Messagelabs Limited (Gen Digital Inc.)
• Inventors: Lee, Martin Giles
• Granted Patent: US 7,817,861 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method of detecting spam images in electronic objects such as emails comprises compressing images extracted from the electronic object into a common representation using a lossy compression function and determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into said common representation using said lossy compression function. The electronic objects are signalled as embedding a spam image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image.

Claims

1. A method of detecting spam images in electronic objects, the method comprising:

extracting images embedded in the electronic objects;

compressing the extracted images into a common representation using a lossy compression function;

determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into said common representation using said lossy compression function; and

signalling electronic objects as embedding a spam image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image.

2. A method according to claim 1, wherein the predetermined representation is a bitmap having a predetermined size and a colour palette of a predetermined number of colours.

3. A method according to claim 2, wherein the predetermined size is 22500 pixels or less.

4. A method according to claim 2, wherein the predetermined size is 13684 pixels or less.

5. A method according to claim 2, wherein the predetermined number of colours is 24 or less.

6. A method according to claim 2, wherein the predetermined size is 400 pixels or more.

7. A method according to claim 2, wherein the predetermined size is 576 pixels or more.

8. A method according to claim 2, wherein the predetermined number of colours is 5 or more.

9. A method according to claim 1, wherein said step of determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images comprises:

calculating the hash values of the compressed, extracted images; and

determining if the hash values of the compressed, extracted images are the same as any one of a stored set of hash values of the compressed forms of the known spam images in said corpus.

10. A method according to claim 9, further comprising a preliminary process of compressing the known spam images into said common representation using said lossy compression function to generate said compressed forms of the known spam images, calculating the hash values of the compressed forms of the known spam images, and storing the hash values of the compressed forms of the known spam images to constitute said stored set of hash values.

11. A method according to claim 1, further comprising a preliminary process of compressing the known spam images into said common representation using said lossy compression function to generate said compressed forms of the known spam images and storing the compressed forms, said determining step being performed by comparing the compressed, extracted images with the stored compressed forms.

12. A method according to claim 1, wherein the method further comprises:

determining, in respect of the compressed forms of the extracted images which are determined to be identical to the compressed form of one of the known spam images in said corpus, if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression; and

said step of signalling electronic objects as embedding a spam image is performed on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image in combination with the size of the respective extracted image without compression being determined to be similar to a predetermined degree to the size of the one of the known spam images without compression.

13. A method according to claim 12, wherein said step of determining if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression comprises:

deriving a bit mask expressing the size of the respective extracted images without compression using a bit mask function which sets respective bits of the bit mask when the size lies in respective ranges, which ranges overlap; and

determining if the derived bit mask has any bit set in common with a stored set of bit masks expressing the size of the known spam images in said corpus without compression and derived using the same bitmap function.

14. A method according to claim 1, wherein the method further comprises, in response to said signalling of electronic objects as embedding a spam image, performing a remedial action in respect of those electronic objects.

15. A method according to claim 1, wherein the electronic objects are emails.

16. A method according to claim 1, wherein the method is performed on electronic objects passed through a node on a network.

17. A method according to claim 1, wherein said lossy compression function is an averaging function which reduces the number of bits of the image to which it is applied.

18. A system for detecting spam images in electronic objects, the system comprising:

an image extraction engine operative to extract images embedded in the electronic objects;

a compression unit operative to compress the extracted images into a common representation using a lossy compression function;

a determination unit operative to determine if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into said common representation using said lossy compression function; and

a signal unit operative to signal electronic objects as embedding a spam image responsive to the determination unit determining that a compressed form of an extracted image extracted from an electronic object is identical to the compressed form of a known spam image.

19. A system according to claim 18, wherein the predetermined representation is a bitmap having a predetermined size and a colour palette of a predetermined number of colours.

20. A system according to claim 19, wherein the predetermined size is 22500 pixels or less.

21. A system according to claim 19, wherein the predetermined size is 13684 pixels or less.

22. A system according to claim 19, wherein the predetermined number of colours is 24 or less.

23. A system according to claim 19, wherein the predetermined size is 400 pixels or more.

24. A system according to claim 19, wherein the predetermined size is 576 pixels or more.

25. A system according to claim 19, wherein the predetermined number of colours is 5 or more.

26. A system according to claim 18, wherein said determination unit is operative to determine if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images by being operative:

to calculate the hash values of the compressed, extracted images; and

to determine if the hash values of the compressed, extracted images are the same as any one of a stored set of hash values of the compressed forms of the known spam images in said corpus.

27. A system according to claim 26, further comprising a reference database generator comprising:

a compression unit operative to compress the known spam images in the corpus into said common representation using said lossy compression function

a hash unit operative to calculate the hash values of the compressed forms of the known spam images, and to store the hash values of the compressed forms of the known spam images to constitute said stored set of hash values.

28. A system according to claim 18, further comprising a reference database generator comprising:

a compression unit operative to compress the known spam images in the corpus into said common representation using said lossy compression function to generate said compressed forms of the known spam images, and to store the compressed forms, said determining step being performed by comparing the compressed, extracted images with the stored compressed forms.

29. A system according to claim 18, wherein the system further comprises:

a second determination unit operative, in respect of the compressed forms of the extracted images which the first mentioned determination unit determines to be identical to the compressed form of one of the known spam images in said corpus, to determine if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression; and

said signalling unit is operative to signal electronic objects as embedding a spam image responsive to the first determination unit determining that a compressed form of an extracted image extracted from an electronic object is identical to the compressed form of a known spam image in combination with the second determination unit determining that the size of the respective extracted image without compression is similar to the predetermined degree to the size of the one of the known spam images without compression.

30. A system according to claim 29, wherein said second determination unit is operative to determine if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression by being operative:

to derive a bit mask expressing the size of the respective extracted images without compression using a bit mask function which sets respective bits of the bit mask when the size lies in respective ranges, which ranges overlap; and

to determine if the derived bit mask has any bit set in common with a stored set of bit masks expressing the size of the known spam images in said corpus without compression and derived using the same bitmap function.

31. A system according to claim 18, further comprising a unit operative, in response to said signalling of electronic objects as embedding a spam image, to perform a remedial action in respect of those electronic objects.

32. A system according to claim 18, wherein the electronic objects are emails.

33. A system according to claim 18, wherein the system is provided at a node of a network and is operative on electronic objects passing through the node.

34. A system according to claim 18, wherein said lossy compression function is an averaging function which reduces the number of bits of the image to which it is applied.

35. A method of detecting reference images in electronic objects, the method comprising:

extracting images embedded in the electronic objects;

compressing the extracted images into a common representation;

determining if the compressed forms of the extracted images are identical to the compressed form, in said common representation, of any reference image from a corpus of reference images; and

signalling electronic objects as embedding a reference image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a reference image.