Image spam

Image-based spam,[1][2] or Image spam, for short, is a kind of E-mail spam where the textual spam message is embedded into images, that are then attached to spam emails. Since most of the email clients will display the image file directly to the user, the spam message is conveyed as soon as the email is opened (there is no need to further open the attached image file).

Fig. 1. Example of a Clean Spam image

The goal of image spam is clearly to circumvent the analysis of the email’s textual content performed by most of the spam filters (e.g., SpamAssassin, RadicalSpam, Bogofilter, SpamBayes). Accordingly, for the same reason, together with the attached image, often spammers add some “bogus” text to the email, namely, a number of words that are most likely to appear in legitimate emails and not in spam. The earlier image spam emails contained spam images in which the text was clean and easily readable, as shown in Fig. 1.

Fig. 2. Examples of obfuscated spam images to evade OCR-based and signature-based detection

Consequently, optical character recognition tools were used to extract the text embedded into spam images, which could be then processed together with the text in the email’s body by the spam filter, or, more generally, by more sophisticated text categorization techniques.[1][3] Further, signatures (e.g., MD5 hashing) were also generated to easily detected and block already known spam images. Spammers in turn reacted by applying some obfuscation techniques to spam images, similarly to CAPTCHAs, both to prevent the embedded text to be read by OCR tools, and to mislead signature-based detection. Some examples are shown in Fig. 2.

This raised the issue of improving image spam detection using computer vision and pattern recognition techniques.[1][2][4][5]

In particular, several authors investigated the possibility of recognizing image spam with obfuscated images by using generic low-level image features (like number of colours, prevalent colour coverage, image aspect ratio, text area), image metadata, etc.[4][5][6][7] (see[2] for a comprehensive survey). Notably, some authors also tried detecting the presence into attached images of text with artifacts denoting an adversarial attempt to obfuscate it.[8][9][10][11]

Image spam started in 2004 and peaked at the end of 2006, when over 50% of spam was image spam. In the middle of 2007, it started declining, and practically disappeared in 2008.[12] However, the reason behind this phenomenon is not easy to understand. The decline of image spam can probably be attributed both to the improvement of the proposed countermeasures (e.g., fast image spam detectors based on visual features), and to the higher requirements in terms of bandwidth of image spam that force spammers to send a smaller amount of spam over a given time interval. Both factors might have made image spam less convenient for spammers than other kinds of spam. Nevertheless, at the end 2011 a rebirth of image spam was detected, and image spam reached 8% of all spam traffic, albeit for a small period.[13]

Fig. 3. Average size of spam versus percentage of Image Spam[12]
Fig. 4. Average size of spam versus percentage of Image and ZIP/RAR Spam (2011-2012, per week)[13]

See also

References

  1. 1 2 3 Giorgio Fumera, Ignazio Pillai, Fabio Roli,"Spam filtering based on the analysis of text information embedded into images". Journal of Machine Learning Research (special issue on Machine Learning in Computer Security), vol. 7, pp. 2699-2720, 12/2006.
  2. 1 2 3 Battista Biggio, Giorgio Fumera, Ignazio Pillai, Fabio Roli,"A survey and experimental evaluation of image spam filtering techniques, Pattern Recognition Letters". Volume 32, Issue 10, 15 July 2011, Pages 1436-1446, ISSN 0167-8655.
  3. ↑ "Bayes OCR Spam Assassin's Plugin".
  4. 1 2 Aradhye, H., Myers, G., Herson, J. A., 2005. Image analysis for efficient cat egorization of image-based spam e-mail. In: Proc. Int. Conf. on Document Analysis and Recognition, pp. 914–918.
  5. 1 2 Dredze, M., Gevaryahu, R., Elias-Bachrach, A., 2007. Learning fast classifiers for image spam. In: Proc. 4th Conf. on Email and Anti-Spam (CEAS)
  6. ↑ Wu, C.-T., Cheng, K.-T., Zhu, Q., Wu, Y.-L., 2005. Using visual features for anti-spam filtering. In: Proc. IEEE Int. Conf. on Image Processing, Vol. III.pp. 501–504.
  7. ↑ Liu, Q., Qin, Z., Cheng, H., Wan, M., 2010. Efficient modeling of spam images. In: Int. Symp. on Intelligent Information Technology and Security Informatics. IEEE Computer Society, pp. 663–666.
  8. ↑ "Fuzzy -OCR Spam Assassin's Plugin".
  9. ↑ Battista Biggio, Giorgio Fumera, Ignazio Pillai, Fabio Roli , "Image Spam Filtering Using Visual Information", 14th Int. Conf. on Image Analysis and Processing (ICIAP 2007), Modena, Italy, IEEE Computer Society, pp. 105--110, 10/09/2007.
  10. ↑ Fabio Roli, Battista Biggio, Giorgio Fumera, Ignazio Pillai, Riccardo Satta , "Image Spam Filtering by Detection of Adversarial Obfuscated Text", Workshop on Neural Information Processing Systems (NIPS), Whistler, British Columbia, Canada, 08/12/2007.
  11. ↑ Battista Biggio, Giorgio Fumera, Ignazio Pillai, Fabio Roli , "Improving Image Spam Filtering Using Image Text Features", Fifth Conference on Email and Anti-Spam (CEAS 2008), Mountain View, CA, USA, 21/08/2008.
  12. 1 2 IBM X-Force® 2010, Mid-Year Trend and Risk Report (August 2010).
  13. 1 2 IBM X-Force® 2012, Mid-Year Trend and Risk Report (September 2012).
This article is issued from Wikipedia - version of the Friday, September 25, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.