Detection of spam images

• US 20090141985A1
• Filed: 12/04/2007
• Published: 06/04/2009
• Est. Priority Date: 12/04/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Targosz, Rob, Sheinin, Michael
• Granted Patent: US 8,103,048 B2
• Time in Patent Office: Days
• US Class Current: 382/202
• CPC Class Codes: G06V 30/10 Character recognition
• CPC Class Codes: G06V 30/18095 Summing image-intensity values; Projection and histogram analysis
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method, system, and computer program product for analyzing image attachments to email messages and reliably determines whether the image includes spam, so that the message can be blocked. A method for processing email messages comprises processing an image included in or attached to an email message to determine whether the image includes features that indicate whether the image is spam and determining whether the image is spam based on the included features that indicate whether the image is spam.

Claims

1. A method of processing email messages, comprising:

processing an image included in or attached to an email message to determine whether the image includes features that indicate whether the image is spam; and

determining whether the image is spam based on the included features that indicate whether the image is spam.

2. The method of claim 1, wherein the processing is performed by:

converting the image to have only luminance information;

detecting contiguous horizontal regions with distinctive luminance; and

detecting horizontal and vertical edges of the contiguous horizontal regions as the features that indicate whether the image is spam.

3. The method of claim 2, wherein the determining is performed by:

determining whether the image is spam based on a ratio of a number of horizontal edges to a number of vertical edges.

4. The method of claim 3, wherein the determining is performed by:

determining that the image is spam when the ratio of a number of horizontal edges to a number of vertical edges is greater than a threshold value.

5. The method of claim 4, wherein the threshold value is included in a range of approximately 10 to 15.

6. The method of claim 2, wherein the contiguous horizontal regions with distinctive luminance are detected by:

performing horizontal smoothening on the image; and

performing segmentation of the image.

7. The method of claim 6, wherein the horizontal smoothening is performed by:

combining multiple pixels by setting each of the combined pixels to an average value of the combined pixels

8. The method of claim 6, wherein the segmentation of the image is performed by:

computing an average luminance value of the image;

dividing each horizontal line in the image into a plurality of equal segments; and

for each segment of each horizontal line in the image;

determining an average and minimum luminance value of the segment, and

marking each pixel of the segment as belonging to a foreground or belonging to a background.

9. The method of claim 8, wherein the determining an average and minimum luminance value of the segment are performed by:

determining that the background is brighter than a content when the average luminance value of the segment is greater than a threshold value and that the background is darker than the content when the average luminance value is less than or equal to the threshold value;

setting a value to be used to mark a segment as belonging to the background to black and a value to be used to mark a segment as belonging to a foreground to white when the background is brighter than the content; and

setting a value to be used to mark a segment as belonging to the background to white and a value to be used to mark a segment as belonging to a foreground to black when the background is darker than the content.

10. The method of claim 9, wherein the marking each pixel of the segment as belonging to a foreground or belonging to a background are performed by:

marking all pixels of the segment as belonging to the background when the average and minimum luminance values of the segment are equal;

marking the pixel as belonging to the background when the luminance of the pixel is greater than the average luminance of the segment; and

marking the pixel as belonging to the fore when the luminance of the pixel is less than or equal to the average luminance of the segment.

11. A system for processing email messages comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

processing an image included in or attached to an email message to determine whether the image includes features that indicate whether the image is spam; and

determining whether the image is spam based on the included features that indicate whether the image is spam.

12. The system of claim 11, wherein the processing is performed by:

converting the image to have only luminance information;

detecting contiguous horizontal regions with distinctive luminance; and

detecting horizontal and vertical edges of the contiguous horizontal regions as the features that indicate whether the image is spam.

13. The system of claim 12, wherein the determining is performed by:

determining whether the image is spam based on a ratio of a number of horizontal edges to a number of vertical edges.

14. The system of claim 13, wherein the determining is performed by:

determining that the image is spam when the ratio of a number of horizontal edges to a number of vertical edges is greater than a threshold value.

15. The system of claim 14, wherein the threshold value is included in a range of approximately 10 to 15.

16. The system of claim 12, wherein the contiguous horizontal regions with distinctive luminance are detected by:

performing horizontal smoothening on the image; and

performing segmentation of the image.

17. The system of claim 16, wherein the horizontal smoothening is performed by:

combining multiple pixels by setting each of the combined pixels to an average value of the combined pixels

18. The system of claim 16, wherein the segmentation of the image is performed by:

computing an average luminance value of the image;

dividing each horizontal line in the image into a plurality of equal segments; and

for each segment of each horizontal line in the image;

determining an average and minimum luminance value of the segment, and

marking each pixel of the segment as belonging to a foreground or belonging to a background.

19. The system of claim 18, wherein the determining an average and minimum luminance value of the segment are performed by:

determining that the background is brighter than a content when the average luminance value of the segment is greater than a threshold value and that the background is darker than the content when the average luminance value is less than or equal to the threshold value;

setting a value to be used to mark a segment as belonging to the background to black and a value to be used to mark a segment as belonging to a foreground to white when the background is brighter than the content; and

setting a value to be used to mark a segment as belonging to the background to white and a value to be used to mark a segment as belonging to a foreground to black when the background is darker than the content.

20. The system of claim 19, wherein the marking each pixel of the segment as belonging to a foreground or belonging to a background are performed by:

marking all pixels of the segment as belonging to the background when the average and minimum luminance values of the segment are equal;

marking the pixel as belonging to the background when the luminance of the pixel is greater than the average luminance of the segment; and

marking the pixel as belonging to the fore when the luminance of the pixel is less than or equal to the average luminance of the segment.

21. A computer program product for processing incoming email messages comprising:

a computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of

processing an image included in or attached to an email message to determine whether the image includes features that indicate whether the image is spam; and

determining whether the image is spam based on the included features that indicate whether the image is spam.

22. The computer program product of claim 21, wherein the processing is performed by:

converting the image to have only luminance information;

detecting contiguous horizontal regions with distinctive luminance; and

detecting horizontal and vertical edges of the contiguous horizontal regions as the features that indicate whether the image is spam.

23. The computer program product of claim 22, wherein the determining is performed by:

determining whether the image is spam based on a ratio of a number of horizontal edges to a number of vertical edges.

24. The computer program product of claim 23, wherein the determining is performed by:

determining that the image is spam when the ratio of a number of horizontal edges to a number of vertical edges is greater than a threshold value.

25. The computer program product of claim 24, wherein the threshold value is included in a range of approximately 10 to 15.

26. The computer program product of claim 22, wherein the contiguous horizontal regions with distinctive luminance are detected by:

performing horizontal smoothening on the image; and

performing segmentation of the image.

27. The computer program product of claim 26, wherein the horizontal smoothening is performed by:

combining multiple pixels by setting each of the combined pixels to an average value of the combined pixels

28. The computer program product of claim 26, wherein the segmentation of the image is performed by:

computing an average luminance value of the image;

dividing each horizontal line in the image into a plurality of equal segments; and

for each segment of each horizontal line in the image;

determining an average and minimum luminance value of the segment, and

marking each pixel of the segment as belonging to a foreground or belonging to a background.

29. The computer program product of claim 28, wherein the determining an average and minimum luminance value of the segment are performed by:

determining that the background is brighter than a content when the average luminance value of the segment is greater than a threshold value and that the background is darker than the content when the average luminance value is less than or equal to the threshold value;

setting a value to be used to mark a segment as belonging to the background to black and a value to be used to mark a segment as belonging to a foreground to white when the background is brighter than the content; and

setting a value to be used to mark a segment as belonging to the background to white and a value to be used to mark a segment as belonging to a foreground to black when the background is darker than the content.

30. The computer program product of claim 29, wherein the marking each pixel of the segment as belonging to a foreground or belonging to a background are performed by:

marking all pixels of the segment as belonging to the background when the average and minimum luminance values of the segment are equal;

marking the pixel as belonging to the background when the luminance of the pixel is greater than the average luminance of the segment; and

marking the pixel as belonging to the fore when the luminance of the pixel is less than or equal to the average luminance of the segment.