Detecting Image Spam

• US 20080178288A1
• Filed: 01/24/2007
• Published: 07/24/2008
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Black, Nick, Gould, Jeremy, Trivedi, Aarjav Jyotindra Neeta, Yang, Weilai, Krasser, Sven, Alperovitch, Dmitri, Schneck, Phyllis Adele, Zdziarski, Jonathan Alexander, Judge, Paul, Tang, Yuchun, Willis, Lamar Lorenzo
• Granted Patent: US 8,763,114 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for operation upon one or more data processors for detecting image spam by detecting an image and analyzing the content of the image to determine whether the incoming communication comprises an unwanted communication.

Claims

1. A computer implemented method operable to image spam, comprising the steps of:

receiving an incoming communication;

determining whether the communication contains one or more images;

analyzing the content of the one or more images to determine whether the incoming communication comprises an unwanted communication; and

performing an action on the communication based upon the result of analyzing the communication.

2. The method of claim 1, wherein analyzing the communication comprises executing an edge detection engine on the image producing an edge detected image, wherein the edge detection engine is operable to use digital signal processing to detect color gradations in an image.

3. The method of claim 2, further comprising normalizing the image prior to analyzing the image producing a normalized image, wherein normalizing is operable to remove features introduced by spammers to evade optical character recognition engines or signature-based detection techniques.

4. The method of claim 3, further comprising executing an optical character recognition engine on the normalized image to produce a text version of the communication.

5. The method of claim 3, wherein normalizing the image comprises removing obfuscation, noise or other irrelevant content from the image.

6. The method of claim 3, wherein normalizing the image comprises executing a median filter on the image.

7. The method of claim 3, wherein normalizing the image comprises quantizing the image to remove extraneous color information.

8. The method of claim 3, wherein normalizing the image comprises executing a contrast stretching engine on the image.

9. The method of claim 1, further comprising normalizing the image prior to analyzing the image producing a normalized image, wherein normalizing is operable to remove features introduced by spammers to evade optical character recognition engines.

10. The method of claim 9, wherein analyzing the content of the image comprises detecting one or more regions and sub-regions within the normalized image.

11. The method of claim 10, wherein analyzing the content of the image further comprises creating fingerprints as digests of image data from overlapping sub-regions of the image.

12. The method of claim 11, further comprising winnowing the resulting fingerprints to identify common sub-regions between the image and known image spam or other previously identified entities.

13. The method of claim 1, wherein analyzing the content of the image comprises identifying high level features to be classified by machine learning engines.

14. The method of claim 13, wherein the machine learning engines uses algorithms such as a clustering technique or a support vector machine.

15. The method of claim 13, wherein analyzing the content of the image comprises deriving histogram modes associated with the image to determine whether the image includes any anomalous histogram modes.

16. The method of claim 15, wherein analyzing the content of the image comprises analyzing the aspect ratio associated with the image to determine whether the image includes an anomalous aspect ratio.

17. The method of claim 16, wherein analyzing the content of the image comprises analyzing the frequency distribution of the image to determine whether the image includes an anomalous frequency distribution.

18. The method of claim 16, wherein analyzing the content of the image comprises analyzing the signal to noise ratio of the image to determine whether the image includes an anomalous signal to noise ratio.

19. The method of claim 18, wherein any anomalies indicate that the communication comprises image spam.

20. The method of claim 1, further comprising analyzing formalities associated with the communication to determine whether any anomalies exist with respect to the communication or the content of the communication.

21. The method of claim 1, further comprising analyzing the communication to detect whether an image is mislabeled as a file type different from the actual file type of the image.

22. The method of claim 1, further comprising analyzing the communication comprises detecting images which are designed to be nonconforming to the corresponding image standard specifications to which the image purports to conform.

23. The method of claim 1, further comprising normalizing the image prior to analyzing the image, the normalizing step producing a normalized image;

and, analyzing the normalized image to detect the existence of image features introduced by spammers to evade edge detection engines.

24. The method of claim 23, wherein the image features comprise banding at the borders and within the image.

25. The method of claim 1, wherein analyzing the communication comprises determining whether the image is legitimate by comparing the image to a set of whitelisted images.

26. The method of claim 1, wherein analysis of the content of the message comprises analyzing the message structure and layout to determine whether a message appears similar to a previously identified malicious message.

27. The method of claim 1, wherein analyzing the communication bearing the one or more images comprises identifying features that may be classified by a machine learning engine.

28. The method of claim 27, wherein analyzing the communication bearing the one or more images comprises executing a Bayesian classification of the communication.

29. An image spam detection system, comprising:

a communications interface operable to receive a communication via a network;

a detector operable to determine whether the communication comprises an image;

an analyzer operable to analyze content associated with the image and to determine whether the image contains unwanted content;

a communications control engine operable to determine an action to perform with respect to the communication based upon the results of the analyzer.

30. The system of claim 29, wherein the analyzer comprises an edge detection engine operable process the image to produce an edge detected image, wherein the edge detection engine is operable to use digital signal processing to detect color gradations in the image.

31. The system of claim 30, further comprising an image normalization engine operable to normalize the image prior to analyzing the image and to produce a normalized image, wherein image normalization engine is operable to remove features introduced by spammers to evade optical character recognition engines or signature based detection techniques.

32. The system of claim 31, further comprising an optical character recognition engine operable to process the normalized image to produce a text version of the communication.

33. The system of claim 31, wherein the image normalization engine is operable to remove obfuscation, noise, or other irrelevant content from the image.

34. The system of claim 31, wherein the imagine normalization engine is operable to execute a median filter on the image.

35. The system of claim 31, wherein the image normalization engine is operable to quantize the image to remove extraneous color information.

36. The method of claim 31, wherein the image normalization engine is operable to execute a contrast stretching engine on the image.

37. The system of claim 29, further comprising an image normalization engine operable to process the image prior to analyzing the image producing a normalized image, wherein processing by the image is operable to remove features introduced by spammers to evade optical character recognition engines.

38. The system of claim 37, wherein the analyzer the content of the image comprises partitioning one or more regions and sub-regions within the normalized image.

39. The system of claim 29, wherein the analyzer comprises fingerprinting engine operable to generate fingerprints as digests of image data from overlapping sub-regions of the image.

40. The system of claim 39, wherein any fingerprints resulting from the fingerprinting engine are winnowed to identify common image sub-regions between the image and known image spam or other previously identified entities.

41. The system of claim 29, wherein the analyzer identifies high level features to be classified by a machine learning engine.

42. The system of claim 41, wherein the machine learning engine comprises a clustering algorithm or a support vector machine.

43. The system of claim 41, wherein the analyzer is operable to derive one or more histogram modes associated with the image to determine whether the image includes any anomalous histogram modes.

44. The system of claim 43, wherein the analyzer is operable to inspect an aspect ratio associated with the image and to determine whether the image includes an anomalous aspect ratio.

45. The system of claim 44, wherein the analyzer is operable to analyze the frequency distribution of the image to determine whether the image includes an anomalous frequency distribution.

46. The system of claim 44, wherein the analyzer is operable to analyze the signal to noise ratio of the image to determine whether the image includes an anomalous signal to noise ratio.

47. The system of claim 46, wherein any anomalies indicate that the communication comprises image spam.

48. The system of claim 29, wherein the analyzer is operable to analyze formalities associated with the communication to determine whether any anomalies exist with respect to the communication or the content of the communication.