Detecting image spam

• US 9,544,272 B2
• Filed: 06/16/2014
• Issued: 01/10/2017
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Intel Corporation
• Inventors: Alperovitch, Dmitri, Black, Nick, Gould, Jeremy, Judge, Paul, Krasser, Sven, Schneck, Phyllis Adele, Tang, Yuchun, Trivedi, Aarjav Jyotindra Neeta, Willis, Lamar Lorenzo, Yang, Weilai, Zdziarski, Jonathan Alexander
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US14/305,877
• Publication Number:
  US 20150040218A1
• Time in Patent Office: 939 Days
• US Class Current: 1/1
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for operation upon one or more data processors for detecting image spam by detecting an image and analyzing the content of the image to determine whether the incoming communication comprises an unwanted communication.

Claims

1. At least one non-transitory machine accessible storage medium having code stored thereon, the code when executed on a machine, cause the machine to:

access received data packets associated with a particular communication from a particular source on a network;

parse the data packets to identify image data included in the particular communication;

determine similarities between the image data of the particular communication and content of a plurality of other communications from a plurality of other sources, wherein the determining similarities comprises determining whether images similar to the image data are included in content of one or more of the other communications, and some of the plurality of other sources have reputable source reputation scores and some of the plurality of other sources have non-reputable source reputation scores;

determine a source reputation score for the particular source, wherein the source reputation score comprises a respective category score of the particular source in a plurality of categories, the plurality of categories comprises a spam category, the source reputation score is calculated based at least in part on determined similarities between the image data and the content of the plurality of other communications, and the source reputation score for the particular source is determined based on both the reputable source reputation scores and the non-reputable source reputation scores in the source reputation scores of the plurality of sources; and

cause the particular communication to be processed based on the reputation score for the particular source.

2. The storage medium of claim 1, wherein at least a portion of the particular communication is to be filtered based on the reputation score.

3. The storage medium of claim 1, wherein the particular communication comprises an email communication.

4. The storage medium of claim 1, wherein the particular communication comprises web traffic.

5. The storage medium of claim 1, wherein the particular communication comprises a short message service (SMS) message.

6. The storage medium of claim 1, wherein the reputation is based on data collected from a plurality of other communications involving the particular source.

7. The storage medium of claim 1, wherein the content comprises data collected by a plurality of agents on the network.

8. The storage medium of claim 1, wherein the reputation score is mapped to an IP address of the particular source.

9. The storage medium of claim 1, wherein the instructions when executed further cause the machine to:

generate one or more fingerprints from the image data; and

compare the fingerprints with fingerprints of known images.

10. The storage medium of claim 9, wherein the known images comprise a first subset of images associated with reputable communications and a second subset of images associated with non-reputable communications.

11. The storage medium of claim 9, wherein the known images comprise known image spam.

12. The storage medium of claim 9, wherein the instructions when executed further cause the machine to determine whether the image data, when rendered, comprises an image that includes text.

13. The storage medium of claim 1, wherein the particular source is associated with an entity, and the entity comprises at least one of a human user or an automated system that participates in transactions on the network.

14. The storage medium of claim 13, wherein the reputation score indicates a reputation of the entity.

15. The storage medium of claim 1, wherein the reputation score comprises a local reputation and a global reputation.

16. The storage medium of claim 1, wherein the reputation score comprises one or more reputation components corresponding to one or more categories in a plurality of categories.

17. The storage medium of claim 13, wherein the one or more categories comprise a spam reputation category.

18. A method comprising:

receiving data packets associated with a particular communication from a particular source on a network;

parsing the data packets to identify image data included in content of a particular communication;

determining similarities between the content of the particular communication and content of a plurality of other communications from a plurality of other sources, wherein determining similarities comprises determining whether images similar to the image data are included in one or more of the other communications, and some of the plurality of other sources have reputable source reputation scores and some of the plurality of other sources have non-reputable source reputation scores;

determining a source reputation score for the particular source based on the similarities and the source reputation scores of the plurality of sources, wherein the source reputation score for the particular source comprises a respective category score of the particular source in a plurality of categories, and the plurality of categories comprises a spam category, and the source reputation score for the particular source is determined based on both the reputable source reputation scores and the non-reputable source reputation scores in the source reputation scores of the plurality of other sources; and

causing the particular communication to be processed based on the reputation score for the particular source.

19. A system comprising:

one or more processor devices;

a storage device;

components to;

access received data packets associated with a particular communication from a particular source on a network;

parse the data packets to identify image data included in a particular communication from a particular source;

determine similarities between the image data of the particular communication and content of a plurality of other communications from a plurality of other sources, wherein determining similarities comprises determining whether images similar to the image data are included in content of one or more of the other communications, and some of the plurality of other sources have reputable source reputation scores and some of the plurality of other sources have non-reputable source reputation scores;

identify a source reputation score for the particular source, wherein the source reputation score comprises a respective category score of the particular source in a plurality of categories, the plurality of categories comprises a spam category, the source reputation score is calculated based at least in part on determined similarities between the image data of the particular communication and the content of the plurality of other communications, and the source reputation score for the particular source is determined based on both the reputable source reputation scores and the non-reputable source reputation scores in the source reputation scores of the plurality of sources; and

cause the particular communication to be processed based on the reputation score for the particular source.

20. The system of claim 19, further comprising a plurality of agents, wherein each agent is to monitor communications on the network and generate data describing the communications, and the data is used to determine the reputation scores.