DETECTING IMAGE SPAM

• US 20150040218A1
• Filed: 06/16/2014
• Published: 02/05/2015
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Alperovitch, Dmitri, Black, Nick, Gould, Jeremy, Judge, Paul, Krasser, Sven, Schneck, Phyllis Adele, Tang, Yuchun, Trivedi, Aarjav Jyotindra Neeta, Willis, Lamar Lorenzo, Yang, Weilai, Zdziarski, Jonathan Alexander
• Granted Patent: US 9,544,272 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for operation upon one or more data processors for detecting image spam by detecting an image and analyzing the content of the image to determine whether the incoming communication comprises an unwanted communication.

Claims

1-48. -48. (canceled)

49. At least one machine accessible storage medium having code stored thereon, the code when executed on a machine, cause the machine to:

identify image data included in a particular communication from a particular source;

determine similarities between the image data and content of a plurality of other communications from a plurality of other sources, wherein some of the plurality of other sources have reputable reputation scores and some of the plurality of other sources have non-reputable reputation scores;

identify a reputation score for the particular source, wherein the reputation score is based on the image data; and

cause the particular communication to be processed based on the reputation score for the particular source.

50. The storage medium of claim 49, wherein at least a portion of the particular communication is to be filtered based on the reputation score.

51. The storage medium of claim 49, wherein the particular communication comprises an email communication.

52. The storage medium of claim 49, wherein the particular communication comprises web traffic.

53. The storage medium of claim 49, wherein the particular communication comprises a short message service (SMS) message.

54. The storage medium of claim 49, wherein reputation is based on data collected from a plurality of other communications involving the particular source.

55. The storage medium of claim 49, wherein the data is collected by a plurality of agents on the network.

56. The storage medium of claim 49, wherein the reputation score is mapped to an IP address of the particular source.

57. The storage medium of claim 49, wherein the instructions when executed further cause the machine to:

generate one or more fingerprints from the image data; and

compare the fingerprints with fingerprints of known images.

58. The storage medium of claim 57, wherein the known images comprise a first subset of images associated with reputable communications and a second subset of images associated with non-reputable communications.

59. The storage medium of claim 57, wherein the known images comprise known image spam.

60. The storage medium of claim 57, wherein the instructions when executed further cause the machine to determine whether the image data, when rendered, comprises an image that includes text.

61. The storage medium of claim 49, wherein the particular source is associated with an entity, and the entity comprises at least one of a human user or an automated system that participates in transactions on the network.

62. The storage medium of claim 61, wherein the reputation score indicates a reputation of the entity.

63. The storage medium of claim 49, wherein the reputation score comprises a local reputation and a global reputation.

64. The storage medium of claim 49, wherein the reputation score comprises one or more reputation components corresponding to one or more categories in a plurality of categories.

65. The storage medium of claim 64, wherein the one or more categories comprise a spam reputation category.

66. A method comprising:

receiving data packets associated with a particular communication from a particular source on a network;

parsing the data packets to identify image data included in particular communication;

determining similarities between content of the particular communication and content of a plurality of other communications from a plurality of other sources, wherein some of the plurality of other sources have reputable reputation scores and some of the plurality of other sources have non-reputable reputation scores;

determining a reputation score for the particular source based on the similarities; and

causing the particular communication to be processed based on the reputation score for the particular source.

67. A system comprising:

one or more processor devices;

a storage device;

components to;

identify image data included in a particular communication from a particular source;

determine similarities between the image data and content of a plurality of other communications from a plurality of other sources, wherein some of the plurality of other sources have reputable reputation scores and some of the plurality of other sources have non-reputable reputation scores;

identify a reputation score for the particular source, wherein the reputation score is based on the image data; and

cause the particular communication to be processed based on the reputation score for the particular source.

68. The system of claim 67, further comprising a plurality of agents, wherein each agent is to monitor communications on the network and generate data describing the communications, and the data is used to determine the reputation scores.