Apparatus and method for detecting images within spam

• US 8,290,203 B1
• Filed: 01/11/2007
• Issued: 10/16/2012
• Est. Priority Date: 01/11/2007
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Myers, John Gardiner, Yang, Yanyan
• Primary Examiner(s): Repko, Jason M
• Assistant Examiner(s): Thirugnanam, Gandhi
• Application Number:
  US11/652,715
• Time in Patent Office: 2,105 Days
• Field of Search: 382/100, 382/181, 382/224, 382305-306, 709/200, 709/202, 726/22, 726/26
• US Class Current: 382/100
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables

Abstract

A method is described that includes comparing a characteristic of an image to stored characteristics of spam images. The method also includes generating a signature of the present image. The method further includes comparing the signature of the present image to stored signatures of spam images. The method also includes determining the spam features corresponding to the stored signatures of spam images that match the signature of the present image.

Claims

1. A computer-implemented method for determining spam features of a present image, comprising:

determining if the present image is oversized and, if so, then classifying the present image as oversized refraining from additional analysis of the present image;

preprocessing the present image if the image is not oversized, the preprocessing including analyzing the present image to obtain an image format, image width, image height and image size;

determining if the image is of a type which is supported and, if not, then classifying the image as unsupported, and refraining from performing any additional analysis of the image;

using a characteristic of the present image, whether corrupted, or not corrupted, as an index to a table having stored characteristics of known spam images, wherein the characteristic includes one or more of the image format, image, width, image height and image size;

performing the following additional operations only if a match exists between the characteristic of the present image and one of the stored characteristics of known spam images;

determining if the image is corrupted and, if the image is not corrupted, then performing a first set of operations which create a non-fuzzy signature of the present image and, if the image is corrupted, then performing a second set of operations which create a fuzzy signature of the image;

comparing the fuzzy or non-fuzzy signature to stored signatures of known spam images, the stored signatures of known spam images having been previously generated from spam images having the same characteristic as the present image;

determining spam features corresponding to the stored signatures of spam images that match the signature of the present image;

wherein generating a signature of the present image includes performing a one-way hash function on the image.

2. The method of claim 1, wherein the hash function is the Message Digest 5 (md5) hash function.

3. The method of claim 1, wherein the characteristic further includes a size of the image.

4. The method of claim 1, wherein the closest value is greater than or equal to the width of the present image.

5. The method of claim 1, wherein the characteristic includes a compression type of the image.

6. The method of claim 1, wherein generating the signature of the present image includes cropping the present image.

7. The method of claim 6, wherein a bottom portion of the present image is cropped out, the remaining image being the present image minus the bottom portion.

8. The method of claim 7, wherein an amount of the bottom portion of the present image to be cropped out is twenty percent of the height of the present image.

9. The method of claim 6, wherein all edges of the present image are cropped out.

10. A computer-implemented method for determining spam features of an image, comprising:

determining if the present image is oversized and, if so, then classifying the present image as oversized refraining from additional analysis of the present image;

preprocessing the present image if the image is not oversized, the preprocessing including analyzing the present image to obtain an image format, image width, image height and image size;

determining if the image is of a type which is supported and, if not, then classifying the image as unsupported, and refraining from performing any additional analysis of the image;

using a characteristic of the present image, whether corrupted, or not corrupted, as an index to a table having characteristics of known spam images, wherein the image is a JPEG image and the characteristic includes at least a width of the JPEG image;

performing the following additional operations only if a match exists between the characteristic of the present image and one of the stored characteristics of known spam images;

determining if the image is corrupted and, if the image is not corrupted, then performing a first set of operations which create a non-fuzzy signature of the present image and, if the image is corrupted, then performing a second set of operations which create a fuzzy signature of the image;

comparing the signature to stored signatures of known spam images, the stored signatures of known spam images having been previously generated from spam images having the same characteristic as the present image;

determining spam features corresponding to the stored signatures of spam images that match the signature of the present image; and

wherein generating a signature of the present image includes performing a one-way hash function on the image.

11. The method of claim 10, wherein the hash function is the Message Digest 5 (md5) hash function.

12. The method of claim 10, wherein the characteristic further includes is a size of the image.

13. The method of claim 10 further comprising:

converting the width of the JPEG image to a closest value of a predefined interval of widths; and

performing the following additional operations only if a match exists between the converted width of the present JPEG image and a converted width of known spam images;

generating a signature of the present JPEG image;

comparing the signature to stored signatures of known spam images, the stored signatures of known spam images having been previously generated from spam images having the same characteristic as the present JPEG image; and

determining spam features corresponding to the stored signatures of spam images that match the signature of the present JPEG image.

14. The method of claim 10, wherein the characteristic includes a compression type of the JPEG image.

15. The method of claim 10, wherein generating the signature of the present JPEG image includes cropping the present image.