Detection of image spam

• US 7,817,861 B2
• Filed: 12/11/2006
• Issued: 10/19/2010
• Est. Priority Date: 11/03/2006
• Status: Expired due to Fees

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Lee, Martin Giles
• Primary Examiner(s): Kim; Charles
• Assistant Examiner(s): Patel; Nirav G
• Application Number:
  US11/636,713
• Publication Number:
  US 20080127340A1
• Time in Patent Office: 1,408 Days
• Field of Search: 382/100
• US Class Current: 382/209
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method of detecting spam images in electronic objects such as emails includes compressing images extracted from the electronic object into a common representation using a lossy compression function and determining if the compressed forms of the extracted images are identical to the compressed form of any known spam image from a corpus of known spam images, which compressed forms are the known spam images compressed into the common representation using the lossy compression function. The electronic objects are signalled as embedding a spam image on the basis of a compressed form of an extracted image extracted from an electronic object being determined to be identical to the compressed form of a known spam image.

Claims

1. A method of detecting spam images in electronic mail, the method comprising:

obtaining one or more known spam e-mails;

obtaining and extracting known spam images from the known spam e-mails;

compressing the extracted known spam images into a common representation having a common size and color palette using a lossy compression function;

using the compressed known spam images to create a corpus of compressed known spam images;

extracting images embedded in a subject electronic mail message;

compressing the extracted images embedded in the subject electronic mail message into a common representation having the common size and color palette using a lossy compression function;

determining if the compressed forms of the extracted images embedded in the subject electronic mail message are identical to the compressed form of any of the extracted known spam images in the corpus of known spam images; and

signaling the subject electronic mail message as embedding a spam image on the basis of a compressed form of an extracted image extracted from the subject electronic mail message being determined to be identical to the compressed form of a known spam image.

2. A method according to, claim 1 wherein the common size is 22500 pixels or less.

3. A method according to claim 1, wherein the common size is 13684 pixels or less.

4. A method according to claim 1, wherein the number of colours included in the common color palette is 24 or less.

5. A method according to claim 1, wherein the common size is 400 pixels or more.

6. A method according to claim 1, wherein the common size is 576 pixels or more.

7. A method according to claim 1, wherein the number of colours included in the common color palette is 5 or more.

8. A method according to claim 1, wherein

determining if the compressed forms of the extracted images embedded in the subject electronic mail message are identical to the compressed form of any of the extracted known spam images in the corpus of known spam images comprises:

calculating the hash values of the compressed forms of the extracted images embedded in the subject electronic mail message; and

determining if the hash values of the compressed forms of the extracted images embedded in the subject electronic mail message are the same as the compressed form of any of the extracted known spam images in the corpus of known spam images.

9. A method according to claim 8, further comprising a preliminary process of calculating the hash values of the compressed forms of the extracted known spam images, and storing the hash values of the compressed forms of the extracted known spam images to constitute a stored set of hash values.

10. A method according to claim 1, wherein the method further comprises:

determining, in respect of the the compressed forms of the extracted images embedded in the subject electronic mail message which are determined to be identical to the compressed form of one of the known spam images in said corpus, if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the extracted known spam images without compression; and

said step of signaling the subject electronic mail message as embedding a spam image is performed on the basis of a compressed form of the extracted image embedded in the subject electronic mail message being determined to be identical to the compressed form of a extracted known spam image in combination with the size of the respective extracted image embedded in the subject electronic mail message without compression being determined to be similar to a predetermined degree to the size of the one of the extracted known spam images without compression.

11. A method according to claim 10,

determining, in respect of the compressed forms of the extracted images embedded in the subject electronic mail message which are determined to be identical to the compressed form of one of the known spam images in said corpus, if the size of the respective extracted images without compression is similar to a predetermined degree to the size of the corresponding one of the extracted known spam images without compression comprises:

deriving a bit mask expressing the size of the respective extracted images embedded in the subject electronic mail message without compression using a bit mask function which sets respective bits of the bit mask when the size lies in respective ranges, which ranges overlap; and

determining if the derived bit mask has any bit set in common with a stored set of bit masks expressing the size of the extracted known spam images in said corpus without compression and derived using the same bitmap function.

12. A method according to claim 1, wherein the method further comprises, in response to said signaling the subject electronic mail message as embedding a spam image, performing a remedial action in respect of the subject electronic mail message.

13. A method according to claim 1, wherein the method is performed on a subject electronic mail message passed through a node on a network.

14. A method according to claim 1, wherein said lossy compression function is an averaging function which reduces the number of bits of the image to which it is applied.

15. A system for detecting spam images in electronic mail messages, the system comprising:

means for obtaining one or more known spam e-mails;

an image extraction engine operative to extract known spam images from the known spam e-mails;

a compression unit operative to compress the known spam images into a common representation having a common size and color palette using a lossy compression function;

an image extraction engine operative to extract images embedded in the electronic mail messages;

a compression unit operative to compress the extracted images embedded in the electronic mail message into a common representation having a common size and color palette using a lossy compression function;

a determination unit operative to determine if the compressed forms of the extracted images embedded in the electronic mail message are identical to the compressed form of any known spam image; and

a signal unit operative to signal electronic mail messages as embedding a spam image responsive to the determination unit determining that a compressed form of an extracted image embedded in an electronic mail message is identical to the compressed form of a known spam image.

16. A system according to claim 15, wherein the common representation is a bitmap.

17. A system according to claim 16, wherein the common size is 22500 pixels or less.

18. A system according to claim 16, wherein the common size is 13684 pixels or less.

19. A system according to claim 16, wherein the number of colours included in the common color palette is 24 or less.

20. A system according to claim 16, wherein the common size is 400 pixels or more.

21. A system according to claim 16, wherein the common size is 576 pixels or more.

22. A system according to claim 16, wherein the number of colours included in the common color palette is 5 or more.

23. A system according to claim 15, wherein said determination unit is operative to determine if the compressed forms of the extracted images embedded in the electronic mail message are identical to the compressed form of any known spam image by being operative:

to calculate the hash values of the compressed, extracted images embedded in the electronic mail message; and

to determine if the hash values of the compressed, extracted images embedded in the electronic mail message are the same as any one of a stored set of hash values of the compressed forms of the known spam images.

24. A system according to claim 23, further comprising a reference database generator comprising:

a hash unit operative to calculate the hash values of the compressed forms of the known spam images, and to store the hash values of the compressed forms of the known spam images to constitute a stored set of hash values.

25. A system according to claim 15, wherein the system further comprises:

a second determination unit operative, in respect of the compressed forms of the extracted images embedded in the electronic mail message which the first mentioned determination unit determines to be identical to the compressed form of one of the known spam images, to determine if the size of the respective extracted images embedded in the electronic mail message without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression; and

said signaling unit is operative to signal electronic mail messages as embedding a spam image responsive to the first determination unit determining that a compressed form of an extracted image extracted from an electronic mail message is identical to the compressed form of a known spam image in combination with the second determination unit determining that the size of the respective extracted image embedded in the electronic mail message without compression is similar to the predetermined degree to the size of the one of the known spam images without compression.

26. A system according to claim 25, wherein said second determination unit is operative to determine if the size of the respective extracted images embedded in the electronic mail message without compression is similar to a predetermined degree to the size of the corresponding one of the known spam images without compression by being operative:

to derive a bit mask expressing the size of the respective extracted images embedded in the electronic mail message without compression using a bit mask function which sets respective bits of the bit mask when the size lies in respective ranges, which ranges overlap; and

to determine if the derived bit mask has any bit set in common with a stored set of bit masks expressing the size of the known spam images without compression and derived using the same bitmap function.

27. A system according to claim 15, further comprising a unit operative, in response to said signaling of electronic mail messages as embedding a spam image, to perform a remedial action in respect of those electronic objects.

28. A system according to claim 15, wherein the system is provided at a node of a network and is operative on electronic mail messages passing through the node.

29. A system according to claim 15, wherein said lossy compression function is an averaging function which reduces the number of bits of the image to which it is applied.