IMAGE SPAM FILTERING BASED ON SENDERS' INTENTION ANALYSIS

• US 20090113003A1
• Filed: 10/31/2007
• Published: 04/30/2009
• Est. Priority Date: 10/31/2007
• Status: Abandoned Application

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Lu, Jun, Cheng, Jiandong
• Application Number:
  US11/932,589
• Publication Number:
  US 20090113003A1
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables

Abstract

Systems and methods for an anti-spam detection module that can detect image spam are provided. According to one embodiment, an image spam detection process involves determining and measuring various characteristics of images that may be embedded within or otherwise associated with an electronic mail (email) message. An approximate display location of the embedded images is determined. The existence of one or more abnormal factors associated with the embedded images is identified. A quantity of text included in the one or more embedded images is determined and measured by analyzing one or more blocks of binarized representations of the one or more embedded images. Finally, the likelihood that the email message is spam is determined based on one or more of the approximate display location, the existence of one or more abnormal factors and the quantity and location of text measured.

Claims

1. A method comprising:

measuring or estimating one or more of the quantity and position of text within an image associated with an electronic message; and

estimating the likelihood that the electronic message is spain based at least in part on results of the measuring or estimating.

2. The method of claim 1, wherein the electronic message comprises an electronic mail (email) message.

3. The method of claim 1, wherein the image is divided up into a plurality of blocks and image processing is applied to each of the plurality of blocks.

4. The method of claim 3, wherein the image processing includes local thresholding.

5. The method of claim 3, wherein the image processing includes global thresholding.

6. The method of claim 1, wherein filtering is applied to the image to remove noise deliberately added by an originator of the electronic message.

7. The method of claim 3, wherein the image processing comprises converting the image or one or more of the plurality of blocks to grayscale.

8. The method of claim 3, further comprising determining which colors or intensities are likely to represent text within the image or within one or more of the plurality of blocks by calculating an intensity histogram for the image or for the one or more of the plurality of blocks.

9. The method of claim 3, wherein the quantity of text is measured or estimated by summing the number of blocks within a portion of the image visible in a preview pane of an email client.

10-27. -27. (canceled)

28. A computer-readable medium having stored thereon instructions, which when executed by one or more processors cause the one or more processors to perform a method comprising:

measuring or estimating one or more of the quantity and position of text within an image associated with an electronic message; and

estimating the likelihood that the electronic message is spain based at least in part on results of the measuring or estimating.

29. The computer-readable medium of claim 28, wherein the electronic message comprises an electronic mail (email) message.

30. The computer-readable medium of claim 28, wherein the image is divided up into a plurality of blocks and image processing is applied to each of the plurality of blocks.

31. The computer-readable medium of claim 30, wherein the image processing includes local thresholding.

32. The computer-readable medium of claim 30, wherein the image processing includes global thresholding.

33. The computer-readable medium of claim 28, wherein filtering is applied to the image to remove noise deliberately added by an originator of the electronic message.

34. The computer-readable medium of claim 30, wherein the image processing comprises convening the image or one or more of the plurality of blocks to grayscale.

35. The computer-readable medium of claim 30, further comprising determining which colors or intensities are likely to represent text within the image or within one or more of the plurality of blocks by calculating an intensity histogram for the image or for the one or more of the plurality of blocks.

36. The computer-readable medium of claim 30, wherein the quantity of text is measured or estimated by summing the number of blocks within a portion of the image visible in a preview pane of an email client.