Countering spam that uses disguised characters

• US 7,921,159 B1
• Filed: 10/14/2003
• Issued: 04/05/2011
• Est. Priority Date: 10/14/2003
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun P.
• Primary Examiner(s): Thomas; Joseph
• Assistant Examiner(s): Kim; Tae K
• Application Number:
  US10/686,356
• Time in Patent Office: 2,730 Days
• Field of Search: 709/246, 709/206, 345/589, 345/594, 356/405, 382/165
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

Computer-implemented methods, apparati, and computer-readable media for countering spam that disguises characters within an electronic message (1). A method embodiment of the present invention comprises locating (36) portions of an electronic message (1) where the difference between foreground color and background color is negligible; deleting (37) from the electronic message (1) foreground characters from said portions, to form a redacted electronic message; and forwarding (33) the redacted electronic message to a spam filter (23).

Claims

1. A method for countering spam that disguises characters within an electronic message, the method implemented on a computer, the method comprising the steps of:

locating portions of the electronic message where a difference in color between foreground color and background color is negligible, the locating performed by a processor of the computer, the locating comprising;

determining whether at least one of the foreground color and the background color is a gray-scale color; and

responsive to at least one of the foreground color and the background color being a gray-scale color, determining a difference in saturation between the foreground color and the background color, determining a difference in brightness between the foreground color an the background color, and deeming the difference in color between the foreground color and the background color to be negligible based on the difference in the saturation and the difference in brightness between the colors regardless of hue values of the colors, said deeming further comprises;

determining that the difference between the colors falls below a negligibility threshold, the negligibility threshold used depending upon a type of monitor on which the electronic message is to be displayed;

deleting from the electronic message foreground characters from said portions, to form a redacted electronic message; and

forwarding the redacted electronic message to a spam filter.

2. The method of claim 1 wherein the negligibility threshold is set such that when the difference between foreground color and background color is below the negligibility threshold for a certain portion of the electronic message, said portion is invisible or illegible to a typical human viewer of the electronic message.

3. The method of claim 2, further comprising:

responsive to at least one of the foreground color and the background color being a gray-scale color, comparing the negligibility threshold to a color difference value, the color difference value based on the differences in saturation values and brightness values of the foreground and background colors.

4. The method of claim 2, wherein the negligibility threshold used when the electronic message is to be displayed on a liquid crystal display (LCD) monitor is different than a negligibility threshold used when the electronic message is to be displayed on a cathode ray tube (CRT) monitor.

5. The method of claim 2, wherein at least one of the foreground color and the background color is a gray-scale color, and wherein a negligibility threshold used when the electronic message is to be displayed on a liquid crystal display (LCD) monitor is less than a negligibility threshold used when the electronic message is to be displayed on a cathode ray tube (CRT) monitor.

6. The method of claim 1 wherein said locating step comprises, responsive to neither the foreground color nor the background color being a gray-scale color, comparing hue, saturation, and brightness of the foreground and background colors.

7. The method of claim 1 wherein the difference between the foreground color and the background color is deemed to be negligible when the difference in saturation between foreground and background is less than 5%, and the difference in brightness between foreground and background is less than 4%.

8. The method of claim 1 wherein the difference between the foreground color and the background color is deemed to be negligible when the difference in saturation between foreground and background is less than 3%, and the difference in brightness between foreground and background is less than 2%.

9. The method of claim 1 wherein neither the foreground color nor the background color is a gray-scale color, and the locating step comprises comparing hue, saturation, and brightness of the foreground and background colors.

10. The method of claim 9 wherein the difference between the foreground color and the background color is deemed to be negligible when the difference in hue between foreground and background is less than 4 degrees, and the combined difference in saturation and brightness values of the foreground and background is less than 12%.

11. The method of claim 1 wherein the spam filter detects spam to based on characters within the redacted electronic message.

12. The method of claim 1 wherein the electronic message is a message from the group of messages consisting of:

e-mail, instant messages, chat room messages, newsgroup messages, wireless messages, Morse code messages, SMS messages, MMS messages, EMS messages, text pager messages, and graphics pager messages.

13. The method of claim 1, wherein determining whether at least one of the foreground color and the background color is a gray-scale color comprises:

determining whether the saturation value of at least one of the foreground color and the background color is zero.

14. The method of claim 1 wherein locating portions of the electronic message where the difference between foreground color and background color is negligible further comprises:

locating color tags in the electronic message, the color tags specifying foreground and background colors; and

dividing the electronic message into portions based on the color tags, wherein different portions have different foreground or background colors.

15. The method of claim 1, wherein one of the foreground color and the background color comprises a gray-scale color and another one of the foreground color and the background color comprises a non-gray-scale color.

16. A non-transitory computer-readable storage medium containing executable computer program instructions for countering spam that disguises characters within an electronic message, said computer program instructions performing the steps of:

locating portions of the electronic message where a difference in color between foreground color and background color is negligible, the locating comprising;

determining whether at least one of the foreground color and the background color is a gray-scale color; and

responsive to at least one of the foreground color and the background color being a gray-scale color, determining a difference in saturation between the foreground color and the background color, determining a difference in brightness between the foreground color an the background color, and deeming the difference in color between the foreground color and the background color to be negligible based on the difference in the saturation and the difference in brightness between the colors regardless of hue values of the colors, said deeming further comprising;

determining that the difference between the colors falls below a negligibility threshold, the negligibility threshold used depending upon a type of monitor on which the electronic message is to be displayed;

deleting from the electronic message foreground characters from said portions, to form a redacted electronic message; and

forwarding the redacted electronic message to a spam filter.

17. The non-transitory computer-readable storage medium of claim 16 wherein the locating step comprises, responsive to neither the foreground color nor the background color being a gray-scale color, comparing hue, saturation, and brightness of the foreground and background colors.

18. The non-transitory computer-readable storage medium of claim 16, wherein determining whether at least one of the foreground color and the background color is a gray-scale color comprises:

determining whether the saturation value of at least one of the foreground color and the background color is zero.

19. An apparatus for countering spam in an electronic message, said apparatus comprising:

at least one processor;

at least one non-transitory computer-readable storage medium containing executable computer program instruction for countering spam that disguises characters within an electronic message, said computer program instructions performing the steps of;

locating portions of the electronic message where a difference in color between foreground color and background color is negligible, the locating comprising;

determining whether at least one of the foreground color and the background color is a gray-scale color; and

responsive to at least one of the foreground color and the background color being a gray-scale color, determining a difference in saturation between the foreground color and the background color, determining a difference in brightness between the foreground color an the background color, and deeming the difference in color between the foreground color and the background color to be negligible based on the difference in the saturation and the difference in brightness between the colors regardless of hue values of the colors, said deeming further comprises;

determining that the difference between the colors falls below a negligibility threshold, the negligibility threshold used depending upon a type of monitor on which the electronic message is to be displayed;

deleting from the electronic message foreground characters from said portions, to form a redacted electronic message; and

forwarding the redacted electronic message to a spam filter.

20. The apparatus of claim 19 wherein the locating means comprises a color comparison module.