IMAGE SPAM FILTERING BASED ON SENDERS' INTENTION ANALYSIS

• US 20090110233A1
• Filed: 05/04/2008
• Published: 04/30/2009
• Est. Priority Date: 10/31/2007
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Lu, Jun, Cheng, Jiandong
• Granted Patent: US 8,180,837 B2
• Time in Patent Office: Days
• US Class Current: 382/100
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables

Abstract

Systems and methods for an anti-spam detection module that can detect image spam are provided. According to one embodiment, an image spam detection process involves determining and measuring various characteristics of images that may be embedded within or otherwise associated with an electronic mail (email) message. An approximate display location of the embedded images is determined. The existence of one or more abnormal factors associated with the embedded images is identified. A quantity of text included in the one or more embedded images is determined and measured by analyzing one or more blocks of binarized representations of the one or more embedded images. Finally, the likelihood that the email message is spam is determined based on one or more of the approximate display location, the existence of one or more abnormal factors and the quantity and location of text measured.

Claims

1. A method comprising:

converting an embedded image of an electronic mail (email) message to a binarized representation by performing thresholding on a grayscale representation of the embedded image;

determining and measuring a quantity of text included in the embedded image by analyzing one or more blocks of the binarized representation; and

classifying the email message as spam or clean based at least in part on the quantity of text measured.

2. The method of claim 1, wherein the embedded image is conveyed formatted in accordance with Graphic Interchange Format (GIF), Joint Photographic Experts Group (JPEG) or Portable Network Graphics (PNG).

3. The method of claim 1, wherein the embedded image comprises an image contained within a file attached to the email message.

4. The method of claim 2, further comprising determining an approximate display location of an embedded image within an electronic mail (email) message.

5. The method of claim 2, further comprising identifying existence of one or more abnormal factors associated with the embedded image.

6. A method comprising:

determining an approximate display location of one or more embedded images within an electronic mail (email) message;

identifying existence of one or more abnormal factors associated with the one or more embedded images;

determining and measuring a quantity of text included in the one or more embedded images by analyzing one or more blocks of binarized representations of the one or more embedded images; and

classifying the email message as spam or clean based on the approximate display location, the existence of one or more abnormal factors and the quantity of text measured.

7. The method of claim 6, further comprising performing image thresholding on grayscale representations of the one or more embedded images.

8. The method of claim 6, wherein the email message comprises a HyperText Markup Language (HTML) formatted email message or an eXtensible Markup Language (XML) formatted email message.

9. The method of claim 8, wherein said determining an approximate display location of one or more embedded images comprises parsing one or more of HTML code, plain text and Multipurpose Internet Mail Extension (MIME) parts of the HTML formatted email message.

10. The method of claim 9, wherein said determining an approximate display location of one or more embedded images further comprises identifying a displaying line of the email message just prior to the one or more embedded images and calculating the approximate displaying location based on a display location of the displaying line.

11. The method of claim 6, wherein a portion of the text included in the one or more embedded images comprises relatively light text in the context of a relatively dark background.

12. The method of claim 6, wherein a portion of the text included in the one or more embedded images comprises relatively dark text in the context of a relatively light background.

13. The method of claim 6, wherein the one or more abnormal factors include illegal base64 encoding, a plurality continues images within one HyperText Markup Language (HTML) part, lower entropy of frames in an animated Graphic Interchange Format (GIF) image or illegal chunk data of Portable Network Graphics (PNG) image.

14. The method of claim 6, wherein image data associated with an embedded image of the one or more embedded images is sent with the email message.

15. The method of claim 6, wherein image data associated with an embedded image of the one or more embedded images is retrieved once a recipient views the email message.

16. The method of claim 6, wherein an embedded image of the one or more embedded images is contained within a file attached to the email message.

17. The method of claim 16, wherein the attached file comprises a Portable Document Format (PDF) file, an Encapsulated PostScript file, a SWF file, a Windows Metafile file, an AutoCAD DXF file or a CorelDraw CDR file.

18. The method of claim 6, wherein file formats of the one or more embedded images are selected from a group comprising Graphic Interchange Format (GIF), Joint Photographic Experts Group (JPEG) and Portable Network Graphics (PNG), Progressive Graphics File (PGF), Tagged Image File Format (TIFF), bit mapped format (BMP), HDP, WDP, XPM, MacOS-PICT, Irix-RGB, Multiresolution Seamless Image Database (MrSID), RAW format, vector format, Scalable Vector Graphics (SVG), Portable Document Format (PDF), Encapsulated PostScript, SWF, Windows Metafile, AutoCAD DXF and CorelDraw CDR.