Filter for blocking image-based spam

• US 8,055,078 B2
• Filed: 02/28/2008
• Issued: 11/08/2011
• Est. Priority Date: 02/28/2008
• Status: Active Grant

• Current Assignee: R2 Solutions LLC (Acacia Research Corporation)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Wei, Ke, Choi, Jaesik, Ramarao, Vishwanth Tumkur
• Primary Examiner(s): Lu; Tom Y
• Application Number:
  US12/039,310
• Publication Number:
  US 20090220166A1
• Time in Patent Office: 1,349 Days
• Field of Search: 382/209, 382/219, 709/206
• US Class Current: 382/209
• CPC Class Codes: G06V 30/10 Character recognition
• CPC Class Codes: G06V 30/162 Quantising the image signal
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A network device and method are directed towards detecting and blocking image spam within a message by employing a weighted min-hash to perform a near duplicate detection (NDD) of determined features within an image as compared to known spam images. The weighting for the min-hash is determined based on employing a machine learning algorithm, such as a perceptron, to identify an importance of each bit in a signature vector of the image. The signature vector is generated by extracting a shape of text in the image using a Discrete Cosine Transform, extracting low-frequency characteristics using a high-pass filter, and then performing various morphological operations to emphasize the shape of the text and reduce noise. Selected feature bits are extracted from the lowest frequency and intensity bits of the resulting signal to generate the signature vector used in the weighted min-hash NDD.

Claims

1. A method for use in managing delivery of content over a network, comprising:

receiving a message, wherein the message includes an image file;

extracting the image file from the message;

generating a signature vector from the image file, wherein the signature vector includes at least low frequency bits and intensity bits determined from the image file;

determining a weighting vector using a machine learning mechanism on a plurality of known other image files;

performing a weighted min-hash near duplicate detection (NDD) using the weighting vector to determine if the signature vector indicates that the image file is likely to be a spam image; and

based on a result of the weighted min-hash NDD, selectively blocking the image file from being delivered to a destination.

2. The method of claim 1, wherein the machine learning mechanism employs a perceptron neural network algorithm to determine an importance of each bit in signature vectors associated with each of the plurality of known other image files.

3. The method of claim 1, wherein generating the signature vector further comprises:

converting the image file from a spatial domain representation of the image file to a frequency domain representation of the image file using a discrete cosine transform to at least extract a shape of text within the image file;

applying a high-pass filter to the frequency domain representation;

performing pixel thresholding on the high-pass filtered result;

quantizing results of the pixel thresholding to compress information within the frequency domain; and

extracting a determined number of low frequency bits from the quantized result; and

combining the extracted low frequency bits with a defined number of intensity bits for the image file to generate the signature vector.

4. The method of claim 1, wherein determining the weighting vector using the machine learning mechanism on a plurality of known other image files further comprises:

training the weighting vector based on comparisons of feature bits within training images within a group of similar images and further based on comparisons of feature bits within training images between training images across groups of different images.

5. The method of claim 1, further comprising:

receiving feedback that the image file is incorrectly identified as image spam or incorrectly identified as non-image spam;

determining a digital signature for the incorrectly identified image file; and

if another image file is received that matches the digital signature, processing the image file based on a corrected identity according to the received feedback.

6. The method of claim 1, further comprising:

determining at least one physical characteristic of the image file; and

if the physical characteristic indicates that statistically, the image file is unlikely to be associated with image spam, enabling the image file and message to be forwarded to a destination.

7. The method of claim 1, further comprising if the image file includes a color image, converting the color image to grayscale.

8. A network device for selectively managing delivery of messages over a network, comprising:

a transceiver to send and receive data over the network; and

a processor that is operative to perform actions, including;

receiving an image file associated with a message;

if the physical characteristic indicates that statistically, the image file is unlikely to be associated with image spam, enabling the image file and message to be forwarded to a destination, otherwise performing the following actions, comprising;

generating a signature vector from the image file, wherein the signature vector includes at least low frequency bits and intensity bits from the image file;

determining a weighting vector using a machine learning mechanism on a plurality of known other image files;

performing a weighted min-hash near duplicate detection (NDD) using the weighting vector to determine if the signature vector indicates that the image file is likely to be a spam image; and

based on a result of the weighted min-hash NDD selectively blocking the image file from being delivered to a destination.

9. The network device of claim 8, wherein the physical characteristic comprises at least one of the following:

a dimension, a file type, a file size, or a compression ratio.

10. The network device of claim 8, wherein the processor is operative to perform actions, further comprising:

receiving feedback that the image file is incorrectly identified as image spam or incorrectly identified as non-image spam;

determining a digital signature for the incorrectly identified image file; and

if another image file is received that matches the digital signature, processing the image file based on a corrected identity according to the received feedback.

11. The network device of claim 8, wherein generating the signature vector further comprises:

resizing the image file to a predetermined size;

if the image file include color, converting the image file to a grayscale image;

performing a discrete cosine transform (DCT) on the image file;

performing high-pass filtering of a result of the DCT on the image file;

performing an inverse DCT on a result of the high-pass filtering;

performing pixel thresholding on a result of the inverse DCT;

performing another DCT on a result of the pixel thresholding;

extracting a defined number of low frequency bits from a result of the other DCT; and

combining the extracted low frequency bits with a defined number of intensity bits for the image file to generate the signature vector.

12. The network device of claim 8, wherein the machine learning mechanism is a neural network perceptron algorithm applied to the plurality of known other image files, wherein the plurality of known other image files includes image files identified as spam images.

13. The network device of claim 12, wherein the plurality of known other image files are organized into groups of images, based on similarities, and comparisons are made using the machine learning mechanism between the groups and within the groups to generate the weighting vector.

14. The network device of claim 8, wherein performing the weighted min-hash NDD further comprises employing random permutations of bits within signature vectors based on the weighting vector.

15. A system for use in selectively enabling delivery of content over a network, comprising:

a message server that is configured and arranged to perform actions, including;

receiving a message; and

if the message includes an image file, providing the image file to an image spam detection component; and

the image spam detection component being configured to perform actions, including;

generating a signature vector from the image file, wherein the signature vector includes at least low frequency bits and intensity bits from the image file;

determining a weighting vector using a machine learning mechanism on a plurality of known other image files;

performing a weighted min-hash near duplicate detection (NDD) using the weighting vector to determine if the signature vector indicates that the image file is likely to be a spam image; and

based on a result of the weighted min-hash NDD selectively blocking the image file from being delivered to a destination.

16. The system of claim 15, wherein the message server is configured and arranged to perform actions, further including:

receiving feedback that the image file is incorrectly identified as image spam or incorrectly identified as non-image spam;

determining a digital signature for the incorrectly identified image file; and

if another image file is received that matches the digital signature, processing the image file based on a corrected identity according to the received feedback.

17. The system of claim 15, wherein the message server is configured and arranged to perform actions, further including:

determining at least one physical characteristic associated with the image file, including at least one of a file type, file size, or file dimension; and

if the at least one physical characteristic statistically indicates that the image file is unlikely to be image spam, then forwarding the message with the image file towards the destination such that the image file is viewable by the recipient at the display.

18. The system of claim 15, wherein generating the signature vector further comprises:

performing a discrete cosine transform (DCT) on the image file;

performing high-pass filtering of a result of the DCT on the image file;

performing an inverse DCT on a result of the high-pass filtering;

performing pixel thresholding on a result of the inverse DCT;

performing another DCT on a result of the pixel thresholding;

extracting a defined number of low frequency bits from a result of the other DCT; and

combining the extracted low frequency bits with a defined number of intensity bits for the image file to generate the signature vector.

19. The system of claim 15, wherein the machine learning mechanism employs a neural network binary classifier to determine the weighting vector based on iterating over the plurality of known other image files, and adjusting weights for each bit within the weighting vector based, in part, on a proper classification of each known other image file or a misclassification of each known other image file within the plurality of known other image files.

20. The system of claim 15, wherein selectively blocking the image file further comprises at least one of purging the message of the image file and allowing the purged message to be delivered, or blocking the message including the image file from being delivered, if the image file is determined to likely be a spam image.