Apparatus and method for detecting images within spam

• US 8,290,311 B1
• Filed: 01/11/2007
• Issued: 10/16/2012
• Est. Priority Date: 01/11/2007
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Yang, Yanyan, Myers, John Gardiner
• Primary Examiner(s): Repko, Jason M
• Assistant Examiner(s): Thirugnanam, Gandhi
• Application Number:
  US11/652,716
• Time in Patent Office: 2,105 Days
• Field of Search: 726/22, 726/26, 709/200, 709/202, 382/100, 382/181, 382/224, 382305-306
• US Class Current: 382/305
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06V 30/413 Classification of content, e.g. text, photographs or tables
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method is described that includes converting the present image of resolution N to resolution M, M being less than N. The method also includes generating a signature of the present converted image. The method further includes comparing the signature of the present converted image to stored signatures of converted spam images, the converted spam images being of resolution M. The method also includes determining spam features corresponding to the stored signatures of converted spam images that match the signature of the present converted image.

Claims

1. A method for determining spam features of a present image, comprising:

determining if the present image is oversized and, if so, then classifying the present image as oversized refraining from additional analysis of the present image;

preprocessing the present image if the image is not oversized, the preprocessing including analyzing the present image to obtain an image compression type, image width, image height and image size;

determining if the image is of a type which is supported and, if not, then classifying the image as unsupported, and refraining from performing any additional analysis of the image;

using the first image characteristic as an index to a table identify a particular group of spam images having the first image characteristic, wherein the image characteristic is selected from the group consisting of an image width, image compression type, and an image size;

determining if the image is corrupted and, if the image is not corrupted, then performing a first set of operations which create a non-fuzzy signature of the present image and, if the image is corrupted, then performing the following operations;

converting the present image of resolution N to resolution M, M being less than N;

generating a signature of the present converted image;

comparing the signature of the present converted image to stored signatures of converted spam images associated with the first characteristic, wherein the comparing of the signature is limited to comparisons to spam images within the first spam image group, the converted spam images being of resolution M; and

determining spam features corresponding to the stored signatures of converted spam images within the first spam image group that match the signature of the present converted image.

2. The method of claim 1, wherein the signature is a vector of numbers.

3. The method of claim 2, wherein the length of the vector is a multiple of the number of pixels of the present converted image.

4. The method of claim 3, wherein the vector includes an at least one number for each pixel of the present converted image, each at least one number representing a value of a pixel of the present converted image.

5. The method of claim 4, wherein the vector includes three numbers for each pixel of the present converted image, the three numbers representing the Red, Green, and Blue values of a pixel of the present converted image, wherein the present converted image is an RGB image.

6. The method of claim 2, wherein comparing the signature of the present converted image to stored signatures of converted spam images, for each comparison between the signature of the present converted image to a signature of a converted spam image, includes:

determining a difference between each number in the vector of the present converted image and the number of the same position in the vector of the converted spam image;

summing the absolute value of the differences; and

determining if the sum is below a predetermined threshold.

7. The method of claim 1, wherein resolution M is four pixels by four pixels.

8. The method of claim 1, wherein the first characteristic comprises a width of the present image and wherein the width of the present images is compared to stored widths of known spam images, wherein the signature of the present converted image is compared only to the stored signatures of converted spam images that are of the same width as the width of the present image.

9. The method of claim 8, further comprising converting the width of the present image to a closest value of a predefined interval of widths.

10. The method of claim 9, wherein the closest value is greater than or equal to the width of the present image.

11. The method of claim 1, wherein creating the signature of the present image includes cropping the present image.

12. The method of claim 11, wherein the bottom portion of the present image is cropped out, the remaining image being the present image minus the bottom portion.

13. The method of claim 12, wherein the amount of the bottom portion of the present image to be cropped out is twenty percent of the height of the present image.

14. The method of claim 11, wherein all edges of the present image are cropped out.

15. The method of claim 11, wherein converting the present image includes depixelating the present image, the present converted image being a blurred representation of the present image.

28. The method as in claim 1 wherein the first characteristic comprises a format of the present image.

29. The method as in claim 28 wherein the format of the present image comprises a GIF image format.

30. The method as in claim 1 further comprising:

combining the features that match the signature of the present image to arrive at a spam score for the present image.

31. The method as in claim 1 further comprising:

initially determining if a size of the present image is over a specified size threshold; and

determining that the present image is not spam if the size of the present image is above the specified size.

32. The method as in claim 1 further comprising:

initially determining if the present image is corrupted; and

determining the first characteristic and converting the present image only if the present image is not corrupted.

16. A non-transitory machine-readable medium having program code stored thereon which, when executed by a machine, cause the machine to perform the operations of:

determining if the present image is oversized and, if so, then classifying the present image as oversized refraining from additional analysis of the present image;

preprocessing the present image if the image is not oversized, the preprocessing including analyzing the present image to obtain an image compression type, image width, image height and image size;

determining if the image is of a type which is supported and, if not, then classifying the image as unsupported, and refraining from performing any additional analysis of the image;

using the first image characteristic as an index to a table identify a particular group of spam images having the first image characteristic, wherein the image characteristic is selected from the group consisting of an image width, image compression type, and an image size;

determining if the image is corrupted and, if the image is not corrupted, then performing a first set of operations which create a non-fuzzy signature of the present image and, if the image is corrupted, then performing the following operations;

converting the present image of resolution N to resolution M, M being less than N;

generating a signature of the present converted image;

comparing the signature of the present converted image to stored signatures of converted spam images associated with the first characteristic, wherein the comparing of the signature is limited to comparisons to spam images within the first spam image group, the converted spam images being of resolution M; and

determining spam features corresponding to the stored signatures of converted spam images within the first spam image group that match the signature of the present converted image.

17. The machine-readable medium of claim 16, wherein the signature is a vector of numbers.

18. The machine-readable medium of claim 17, wherein the length of the vector is a multiple of the number of pixels of the present converted image.

19. The machine-readable medium of claim 18, wherein the vector includes an at least one number for each pixel of the present converted image, each at least one number representing a value of a pixel of the present converted image.

20. The machine-readable medium of claim 19, wherein the vector includes three numbers for each pixel of the present converted image, the three numbers representing the Red, Green, and Blue values of a pixel of the present converted image, wherein the present converted image is an RGB image.

21. The machine-readable medium of claim 17, wherein comparing the signature of the present converted image to stored signatures of converted spam images, for each comparison between the signature of the present converted image to a signature of a converted spam image, includes:

determining a difference between each number in the vector of the present converted image and the number of the same position in the vector of the converted spam image;

summing the absolute value of the differences; and

determining if the sum is below a predetermined threshold.

22. The machine-readable medium of claim 16, wherein resolution M is four pixels by four pixels.

23. The machine-readable medium of claim 16, wherein the first characteristic comprises a width of the present image and wherein the width of the present images is compared to stored widths of known spam images, wherein the signature of the present converted image is compared only to the stored signatures of converted spam images that are of the same width as the width of the present image.

24. The machine-readable medium of claim 23, further comprising converting the width of the present image to a closest value of a predefined interval of widths.

25. The machine-readable medium of claim 16, wherein creating the signature of the present image includes cropping the present image.

26. The machine-readable medium of claim 16, wherein converting the present image includes depixelating the present image, the present converted image being a blurred representation of the present image.

33. The machine-readable medium as in claim 16 wherein the first characteristic comprises a format of the present image.

34. The machine-readable medium as in claim 33 wherein the format of the present image comprises a GIF image format.

35. The machine-readable medium as in claim 16 comprising additional program code to cause the machine to perform the operations of:

combining the features that match the signature of the present image to arrive at a spam score for the present image.

36. The machine-readable medium as in claim 16 comprising additional program code to cause the machine to perform the operations of:

initially determining if a size of the present image is over a specified size threshold; and

determining that the present image is not spam if the size of the present image is above the specified size.

37. The machine-readable medium as in claim 16 comprising additional program code to cause the machine to perform the operations of:

initially determining if the present image is corrupted; and

determining the first characteristic and converting the present image only if the present image is not corrupted.

27. A computer system comprising a memory for storing program code and a processor for executing the program code to perform the operations of:

determining if the present image is oversized and, if so, then classifying the present image as oversized refraining from additional analysis of the present image;

preprocessing the present image if the image is not oversized, the preprocessing including analyzing the present image to obtain an image compression type, image width, image height and image size;

determining if the image is of a type which is supported and, if not, then classifying the image as unsupported, and refraining from performing any additional analysis of the image;

using the first image characteristic as an index to a table identify a particular group of spam images having the first image characteristic, wherein the image characteristic is selected from the group consisting of an image width, image compression type, and an image size;

determining if the image is corrupted and, if the image is not corrupted, then performing a first set of operations which create a non-fuzzy signature of the present image and, if the image is corrupted, then performing the following operations;

converting the present image of resolution N to resolution M, M being less than N;

generating a signature of the present converted image;

comparing the signature of the present converted image to stored signatures of converted spam images associated with the first characteristic, wherein the comparing of the signature is limited to comparisons to spam images within the first spam image group, the converted spam images being of resolution M; and

determining spam features corresponding to the stored signatures of converted spam images within the first spam image group that match the signature of the present converted image.