Patent Application
20080131005
1. Field of the Invention
The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for identifying inappropriate text content in images.
2. Description of the Background Art
Electronic mail (“email”) has become a relatively common means of communication among individuals with access to a computer network, such as the Internet. Among its advantages, email is relatively convenient, fast, and cost-effective compared to traditional mail. It is thus no surprise that a lot of businesses and home computer users have some form of email access. Unfortunately, the features that make email popular also lead to its abuse. Specifically, unscrupulous advertisers, also known as “spammers,” have resorted to mass emailings of advertisements over the Internet. These mass emails, which are also referred to as “spam emails” or simply “spam,” are sent to computer users regardless of whether they asked for them or not. Spam includes any unsolicited email, not just advertisements. Spam is not only a nuisance, but also poses an economic burden.
Previously, the majority of spam consisted of text and images that are linked to websites. More recently, spammers are sending spam with an image containing the inappropriate content (i.e., the unsolicited message). The reason for embedding inappropriate content in an image is that spam messages can be distinguished from normal or legitimate messages in at least two ways. For one, the inappropriate content (e.g., words such as “Viagra”, “free”, “online prescriptions,” etc.) can be readily detected by keyword and statistical filters (e.g., see Sahami M., Dumais S., Heckerman D., and Horvitz E., “A Bayesian Approach to Filtering Junk E-mail,” AAAI'98 Workshop on Learning for Text Categorization, 27 Jul. 1998, Madison, Wis.). Second, the domain in URLs (uniform resource locators) in the spam can be compared to databases of known bad domains and links (e.g., see Internet URL <http://www.surbl.org/>).
In contrast, a spam email where the inappropriate content and URLs are embedded in an image may be harder to classify because the email itself does not contain obvious spammy textual content and does not have a link/domain that can be looked up in a database of bad links/domains.
Using OCR (optical character recognition) techniques to identify spam images (i.e., images having embedded spammy content) have been proposed because OCR can be used to identify text in images. In general, use of OCR for anti-spam applications would involve performing OCR on an image to extract text from the image, scoring the extracted text, and comparing the score to a threshold to determine if the image contains spammy content. Examples of anti-spam applications that may incorporate OCR functionality include the SpamAssassin and Barracuda Networks spam filters. Spammers responded to OCR solutions in spam filters with images deliberately designed with anti-OCR features. Other approaches to combat spam images include flesh-tone analysis and use of regular expressions.
The present invention provides a novel and effective approach for identifying content in an image even when the image has anti-OCR features.
In one embodiment, an expression from a listing of expressions is selected. The listing of expressions may include words, phrases, or other textual content indicative of a type of message. Using the selected expression as a reference, the image is searched for a section that could be similar to the selected expression. The similarity between the selected expression and the section of the image may be in terms of shape. The section may be scored against the selected expression to determine how well the selected expression matches the section. The score may be used to determine whether or not the selected expression is present in the image. Embodiments of the present invention may be used in a variety of applications including antispam, anti-phishing, identification of confidential information in emails, identification of communications that breach policies or regulations in emails, and other computer security applications involving identification of text content in images.
These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims.
The use of the same reference label in different drawings indicates the same or like components.
In the present disclosure, numerous specific details are provided, such as examples of apparatus, components, and methods, to provide a thorough understanding of embodiments of the invention. Persons of ordinary skill in the art will recognize, however, that the invention can be practiced without one or more of the specific details. In other instances, well-known details are not shown or described to avoid obscuring aspects of the invention.
Referring now to
The antispam engine 320 may comprise computer-readable program code for identifying spam emails or other data with inappropriate content, which may comprise text that includes one or more words and phrases identified in the expressions 322. The antispam engine 320 may be configured to extract an image 323 from an email 324, use the OCR module 321 to extract text from the image 323, and process the extracted text output to determine if the image 323 includes inappropriate content, such as an expression 322. For example, the antispam engine 320 may be configured to determine if one or more expressions in the expressions 322 are present in the extracted text. The antispam engine 320 may also be configured to directly process the image 323, without having to extract text from the image 323, to determine whether or not the image 323 includes inappropriate content. For example, the antispam engine 320 may directly compare the expressions 322 to sections of the image 323. The antispam engine 320 may deem emails 324 with inappropriate content as spam.
The OCR module 321 may comprise computer-readable program code for extracting text from an image. The OCR module 321 may be configured to receive an image in the form of an image file or other representation and process the image to generate text from the image. The OCR module 321 may comprise a conventional OCR module. In one embodiment, the OCR module 321 is employed to extract embedded texts from the images 323, which in turn are extracted from the emails 324.
The expressions 322 may comprise words, phrases, terms, or other character combinations or strings that may be present in spam images. Examples of such expressions may include “brokers,” “companyname” (particular companies), “currentprice,” “5daytarget,” “strongbuy,” “symbol,” “tradingalert” and so on. The expressions 322 may be obtained from samples of confirmed spam emails, for example.
As will be more apparent below, embodiments of the present invention are adversarial in that they select an expression from the expressions 322 and specifically look for the selected expression in the image, either directly or from the text output of the OCR module 321. That is, instead of extracting text from an image and querying whether the extracted text is in a listing of expressions, embodiments of the present invention ask the question of whether a particular expression is in an image. The adversarial approach allows for better accuracy in identifying inappropriate content in images in that it focuses search for a particular expression, allowing for more accurate reading of text embedded in images.
The emails 324 may comprise emails received over the computer network interface 105 or other means. The images 323 may comprise images extracted from the emails 324. The images 324 may be in any conventional image format including JPEG, TIFF, etc.
The method 400 starts after the antispam engine 320 extracts an image 323 from an email 324. The antispam engine 320 then selects an expression from the expressions 322 (step 401). Using the selected expression as a reference, the antispam engine 320 determines if there is a section of the image 323 that corresponds to the start and end of the selected expression (step 402). That is, the selected expression is used as a basis in finding a corresponding section. For example, the antispam engine 320 may determine if the image 323 includes a section that looks similar to the selected expression 322 in terms of shape. The antispam engine 320 then compares the selected expression 322 to the section to determine the closeness of the selected expression 322 to the section. In one embodiment, this is performed by the antispam engine 320 by scoring the section against the selected expression (step 403). The score may reflect how close the selected expression 322 is to the section. For example, the higher the score, the higher the likelihood that the selected expression 322 matches the section. A minimum threshold indicative of the amount of correspondence required to obtain a match between an expression 322 and a section may be predetermined. The value of the threshold may be obtained and optimized empirically. If the score is higher than the threshold, the antispam engine 320 may deem the selected expression 322 as being close enough to the section that a match is obtained, i.e., the selected expression 322 is deemed found in the image 323 (step 404). In that case, the antispam engine 320 records that the selected expression was found at the location of the section in the image 323. For each image 323, the antispam engine 320 may repeat the above-described process for each of the expressions 322 (step 405). A separate scoring procedure may be performed for all identified expressions 322 to determine whether or not the image is a spam image. For example, once the expressions 322 present in the image 323 have been identified, the antispam engine 320 may employ conventional text-based algorithms to determine if the identified expressions 322 are sufficient to deem the image 323 a spam image. The email 324 from which a spam image was extracted may be deemed as spam.
The method 500 starts after the antispam engine 320 extracts an image 323 from an email 324. The OCR module 321 then extracts text from the image, hereinafter referred to as “OCR text output” (step 501). The antispam engine 320 selects an expression from the expressions 322 (step 502). Using the selected expression as a reference, the antispam engine 320 finds an occurrence in the OCR text output that is suitably similar to the selected expression 322 (step 503). For example, the antispam engine 320 may find one or more occurrences in the OCR text output that could match the beginning and end of the selected expression 322 in terms of shape. Conventional shape matching algorithms may be employed to perform the step 503. For example, the antispam engine may employ the shape matching algorithm disclosed in the publication “Shape Matching and Object Recognition Using Shape Contexts”, S. Belongie, J. Malik, and J. Puzicha., IEEE Transactions on PAMI, Vol 24, No. 24, April 2002. Other shape matching algorithms may also be employed without detracting from the merits of the present invention.
The antispam engine 320 determines the closeness of the selected expression 322 to each found occurrence, such as by assigning a score indicative of how well the selected expression 322 matches each found occurrence in the OCR text output (step 504). For example, the higher the score, the higher the likelihood the selected expression 322 matches the found occurrence. The similarity between the selected expression 322 and a found occurrence may be scored, for example, using the edit distance algorithm or the viterbi algorithm (e.g., see “Using Lexigraphical Distancing to Block Spam”, Jonathan Oliver, in Presentation of the Second MIT Spam Conference, Cambridge, Mass., 2005 and “Spam deobfuscation using a hidden Markov model”, Honglak Lee and Andrew Y. Ng. in Proceedings of the Second Conference on Email and Anti-Spam (CEAS 2005)). Other scoring algorithms may also be used without detracting from the merits of the present invention.
In the method 500, a minimum threshold indicative of the amount of correspondence required to obtain a match between an expression 322 and a found occurrence may be predetermined. The value of the threshold may be obtained and optimized empirically. If the score of the step 504 is higher than the threshold, the antispam engine 320 may deem the selected expression 322 as being close enough to the occurrence that a match is obtained, i.e., the selected expression 322 is deemed found in the image 323 (step 505). In that case, the antispam engine 320 records that the selected expression was found at the location of the occurrence in the image 323. For each image 323, the antispam engine 320 may repeat the above-described process for each of the expressions 322 (step 506). A separate scoring procedure may be performed for all identified expressions 322 to determine whether or not the image is a spam image. For example, once the expressions 322 present in the image 323 have been identified, the antispam engine 320 may employ conventional text-based algorithms to determine if the identified expressions 322 are sufficient to deem the image 323 a spam image. The email 324 from which a spam image was extracted may be deemed as spam.
The method 800 starts after the antispam engine 320 extracts an image 323 from an email 324. The antispam engine 320 then selects an expression from the expressions 322 (step 801). The antispam engine 320 finds a section in the image 323 that is suitably similar to the selected expression 322 (step 802). For example, the antispam engine 320 may find a section in the image 323 that could match the beginning and end of the selected expression 322 in terms of shape. A shape matching algorithm, such as that previously mentioned with reference to step 503 of
The antispam engine 320 builds a text string directly (i.e., without first converting the image to text by OCR, for example) from the section of the image and then scores the text string against the selected expression to determine the closeness of the selected expression 322 to the found section (step 803). The higher the resulting score, the higher the likelihood the selected expression 322 matches the section. For example, to identify the text string, the antispam engine 320 may process the section of the image 323 between the potential start and end points that could match the selected expression 322. The pixel blocks in between the potential start and end points (a region of connected pixels) are then assigned probabilities of being the characters under consideration (for example the characters in the ASCII character set). The pixel blocks in between the potential start and end points are then scored using the aforementioned edit algorithm or viterbi algorithm to determine the similarity of the selected expression 322 to the found section.
In the method 800, a minimum threshold indicative of the amount of correspondence required to obtain a match between an expression 322 and a found section may be predetermined. The value of the threshold may be obtained and optimized empirically. If the score of the similarity between the selected expression 322 and the found section of the image 323 is higher than the threshold, the antispam engine 320 may deem the selected expression 322 as being close enough to the found section that there is a match, i.e., the selected expression 322 is deemed found in the image 323 (step 804). In that case, the antispam engine 320 records that the selected expression was found at the location of the section in the image 323. For each image 323, the antispam engine 320 may repeat the above-described process for each of the expressions 322 (step 805). A separate scoring procedure may be performed for all identified expressions 322 to determine whether or not an image is a spam image. For example, once the expressions 322 present in the image 323 have been identified, the antispam engine 320 may employ conventional text-based algorithms to determine if the identified expressions 322 are sufficient to deem the image 323 a spam image. The email 324 from which a spam image was extracted may be deemed as spam.
In light of the present disclosure, those of ordinary skill in the art will appreciate that embodiments of the present invention may be employed in applications other than antispam. This is because the above-disclosed techniques may be employed to identify text content in images in general, the images being present in various types of messages including emails, web page postings, electronic documents, and so on. For example, the components shown in
Improved techniques for identifying inappropriate text content in images have been disclosed. While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.
This application claims the benefit of U.S. Provisional Application No. 60/872,928, filed on Dec. 4, 2006, which is incorporated herein by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 60872928 | Dec 2006 | US |
