KR20160000574A - Apparatus and method for filtering image spam - Google Patents

Abstract

The present invention provides an apparatus and method for filtering an image spam. The method for filtering an image spam comprises the following steps: determining whether a received message is an image message; converting an image included in the message into a gray scale by binarizing the image when the message is an image message; extracting local binary pattern (LBP) information by using the image converted into the gray scale; classifying the extracted LBP information by using a support vector machine (SVM) classification algorithm; and determining whether the message is an image spam based on the classification result.

Description

[0001] APPARATUS AND METHOD FOR FILTERING IMAGE SPAM [0002]

Embodiments of the present invention are directed to an apparatus and method for filtering image spam using image binarization.

With the rapid growth of the Internet, the number of e-mail users has increased and the volume of spam messages has increased due to the exposure of personal e-mail addresses on the Internet. This phenomenon has been exploited by mail users, causing virus transmission and personal information exposure.

Accordingly, various methods of blocking spam messages have been proposed.

One of the representative methods is a text-based spam filtering method. Text-based spam filtering is a method of extracting the text content of a received message and comparing the contents of the text with the contents of text classified as spam to determine whether the received message is spam.

Currently, spam message filtering algorithms embedded in mobile text messages and e-mail on the Web are mostly text based.

The text-based spam filtering technique extracts text from the contents of a message when it is received, compares the text with the text of the received message, retrieves spam text data from the classified database judged as spam text.

If the comparison result shows that there is finally matching information, the message can be determined as spam.

At this time, the text-based spam filtering technique can go through a preprocessing step. In order to filter by comparison with the words registered as spam from the text, the special character of the text message is removed in the preprocessing step, the automatic spacing between sentences is added, Standardization, and deletion of idiomatic words such as slang that do not exist in the actual dictionary. The text-based spam filtering technique can determine whether the text message is spam through the SVM (Support Vector Machine) which is learned in the pattern of the filtering word after the preprocessing step.

The existing text-based spam filtering technique is based on the premise that text extraction is possible in received messages. However, in the case of image spam that contains little text or contains only images or HTML, there is little text that can be compared and judged, so it can not be blocked by existing text-based spam filtering techniques.

An embodiment of the present invention provides an apparatus and method for filtering an image spam message that is difficult to block by spam filtering because the message content is in the form of an image rather than text.

One embodiment of the present invention provides a method for blocking image spam included in a text message through a mobile device, an electronic mail through a web account on the Internet, and the like.

One embodiment of the present invention can prevent viruses and malicious programs that are spread as image spam.

The image spam filtering apparatus according to an exemplary embodiment of the present invention includes a message determination unit for determining whether a received message is an image message or not, and if the message is an image message, converting the image included in the message into a gray scale An LBP extractor for extracting LBP information from the image converted into the gray-scale image, and an SVM (Support Vector Machine) classification algorithm to classify the extracted LBP information, And a spam determination unit for determining whether the message is image spam based on the result.

According to an aspect of the present invention, the spam determining unit may determine the image as the image spam when the gray level of the converted image is analyzed to have a predetermined frequency between predetermined levels.

The image spam filtering apparatus according to an aspect of the present invention further includes an learning unit that selects some patterns among patterns extracted from the extracted LBP information as learning data and learns the selected learning data through SVM (Support Vector Machine) can do.

According to one aspect of the present invention, the spam determining unit may determine whether the message is image spam based on a hyperplane of the learned learning data based on a pattern of the entire image spam learned in advance.

According to an aspect of the present invention, the LBP extractor calculates eLBP (edge-LBP) information by applying a weight to the LBP information for each pixel unit of the transformed image, and the spam determiner includes a Support Vector Machine (SVM) The extracted eLBP information may be classified using the extracted eLBP information, and it may be determined whether the message is image spam based on the classified result.

According to another aspect of the present invention, there is provided an image spam filtering method comprising: determining whether a received message is an image message; converting the image included in the message into grayscale when the message is an image message; Extracting Local Binary Pattern (LBP) information from the image converted into the gray scale, classifying the extracted LBP information using a Support Vector Machine (SVM) classification algorithm, Is image spam.

The image spam filtering method according to an aspect of the present invention may further include the step of determining the message as image spam when the gray level of the converted image is analyzed and the predetermined number of frequencies is set between predetermined levels.

According to an aspect of the present invention, there is provided a method of filtering an image spam, comprising the steps of: selecting a pattern among patterns extracted from the extracted LBP information as learning data; and learning the selected learning data through SVM (Support Vector Machine) .

According to an aspect of the present invention, there is provided a method for filtering image spam, comprising the steps of: determining whether the message is image spam based on a hyperplane of the learned learning data based on a pattern of all learned image spam .

The image spam filtering method according to an aspect of the present invention includes the steps of calculating eLBP (edge-LBP) information by applying a weight to the LBP information for each pixel unit of the transformed image, and using SVM (Support Vector Machine) And classifying the extracted eLBP information, and determining whether the message is image spam based on the classified result.

According to an embodiment of the present invention, an image spam message, which is difficult to be blocked by spam filtering, can be filtered because the message content is an image format rather than a text.

According to an embodiment of the present invention, image spam included in a text message through a mobile device, an electronic mail through a web account on the Internet, and the like can be blocked.

According to an embodiment of the present invention, it is possible to prevent viruses and malicious programs that are distributed as image spam.

1 is a block diagram illustrating a configuration of an image spam filtering apparatus according to an embodiment of the present invention.
2 is a diagram showing an example of image conversion according to an aspect of the present invention.
3 is a diagram illustrating an example of extracting LBP information according to one aspect of the present invention.
4 is a diagram illustrating an eLBP (edge-LBP) feature extraction process according to an aspect of the present invention.
5 is a diagram showing an example of classifying categories of SVMs.
6 is a diagram showing an example of selecting a hyperplane in the SVM classification algorithm.
7 is a flowchart illustrating an image spam filtering method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings and accompanying drawings, but the present invention is not limited to or limited by the embodiments.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The terminology used herein is a term used for appropriately expressing an embodiment of the present invention, which may vary depending on the user, the intent of the operator, or the practice of the field to which the present invention belongs. Therefore, the definitions of these terms should be based on the contents throughout this specification.

An embodiment of the present invention provides an apparatus and method for filtering an image spam message that is difficult to block by spam filtering because the message content is in the form of an image rather than text.

1 is a block diagram illustrating a configuration of an image spam filtering apparatus according to an embodiment of the present invention.

1, an image spam filtering apparatus according to an exemplary embodiment of the present invention includes a message determination unit 110, an image conversion unit 120, an LBP extraction unit 130, a spam determination unit 140, (150).

According to one aspect of the present invention, the image spam filtering apparatus may include a controller 160, and the controller 160 may control the overall operation of the image spam filtering apparatus. For example, the control unit 160 may transmit and receive data between connected modules and transmit the data to another module, or may generate control data to control each module. In addition, each module may be driven under the control of the control unit 160 or independently of the control unit 160.

The determination unit 110 determines whether the received message is an image message.

For example, the determination unit 110 may determine the message as an image message if the received message includes an image file or if the ratio of the image file is high even if the text file is included.

If the message is an image message, the image conversion unit 120 binarizes the image included in the message and converts the image into grayscale.

For example, if the message is determined as an image message, the image conversion unit 120 may convert the image file included in the image message into a gray scale (e.g., a method of binarizing the image) by binarizing the image file.

2 is a diagram showing an example of image conversion according to an aspect of the present invention.

2, if the image included in the received message is a color image 211 or 212, the image conversion unit 120 binarizes the color image 211 or 212 to generate a gray-scale image 221 or 222 ). ≪ / RTI >

The LBP extractor 130 extracts LBP (Local Binary Pattern) information from the image converted into the gray scale.

3 is a diagram illustrating an example of extracting LBP information according to one aspect of the present invention.

2 and 3, the LBP extracting unit 130 extracts LBP information representing the texture information of the image from the gray-scale images 221 and 222 of FIG. 2 as binary data, and outputs histograms 311 and 312 ) can do. LBP is a method of extracting image information as a binary pattern, and it can express feature of image texture.

According to one aspect of the present invention, the LBP extracting unit 130 may apply an eLBP (edge-LBP) representing a lot of texture information with a small dimension in the image.

To facilitate understanding of the present invention, an eLBP (edge-LBP) feature extraction technique will be described as follows. The eLBP feature extraction technique is designed to represent texture boundary information.

4 is a diagram illustrating an eLBP (edge-LBP) feature extraction process according to an aspect of the present invention.

4, if the pixel value of the center pixel is greater than the difference between the pixel values of the center pixel and the neighboring pixel in the 3-by-3 pixel block unit 410, (420).

The values of the pixel block unit 420 may be multiplied by weights, and added to the vertical and horizontal components separately. For example, the weights of 1, 1, 2, 2, 4, 4, 8, and 8 may be multiplied by the values of the pixel block unit 420, and then added by vertical and horizontal components 430 and 440.

[Equation 1]

eLBP _Vh = 2

eLBP _diag = 2 + 4 = 6

&Quot; (2) "

∴ eLBP _total = eLBP _Vh + eLBP _diag = 2 + 6 = 8

In this case, the eLBP _Vh is a value representing vertical and horizontal information of a pixel, and the eLBP _diag is a value representing a diagonal information of a pixel.

Finally, the _total eLBP value of the image can be expressed by adding eLBP _Vh and eLBP _diag .

The spam determining unit 140 classifies the extracted LBP information using a support vector machine (SVM) classification algorithm, and determines whether the message is image spam based on the classified result.

For example, the spam determination unit 140 may analyze the gray level of the converted image and determine the message as image spam if the predetermined level has a predetermined frequency.

Specifically, the image spam may have a frequency number of the gray level corresponding to a gray level of 155 to 170 or 220 to 230 on average, as shown in FIG. These features can serve as a criterion for determining accurate classification thresholds in SVM learning and can be an important criterion for determining whether images are spammed.

In addition, the LBP extractor 130 calculates eLBP (edge-LBP) information by applying a weight to the LBP information for each pixel unit of the transformed image. The spam determiner 140 classifies SVM (Support Vector Machine) Algorithm to classify the extracted eLBP information, and determine whether the message is image spam based on the classified result.

Referring again to FIG. 1, the learning unit 150 selects some patterns among patterns extracted from the extracted LBP information as learning data, and learns the selected learning data through SVM (Support Vector Machine) .

The spam determining unit 140 can determine whether the message is image spam based on a hyperplane of the learned learning data based on the pattern of the entire image spam learned in advance.

The Support Vector Machine (SVM), which is generally referred to throughout the present invention, is one of the machine learning techniques. SVM (Support Vector Machine) classification algorithm is used to find a point for separating the data for a given data .

FIG. 5 is a diagram showing an example of classifying SVM categories, and FIG. 6 is a diagram illustrating an example of selecting a hyperplane in the SVM classification algorithm.

Referring to FIGS. 5 and 6, the SVM classification algorithm can be displayed in a vector space and can be classified as linear or non-linear. 5 and 6, a polygon consisting of connecting lines of vectors positioned on the basis of the same category is referred to as a convex hull. Other vectors in the convex hull do not affect group classification, Vectors located outside can have a big impact.

As shown in Fig. 5, the outermost vectors are referred to as support vectors, and the lines and planes that divide support vectors are referred to as hyperplanes.

As shown in FIG. 6, a plurality of hyperplanes H1, H2, and H3 may occur, but H2, which is a hyperplane having the farthest distance from the support vector, can effectively classify the two groups.

The learning unit 150 may extract only some patterns randomly from the spam patterns and non-spam patterns extracted through the eLBP feature extraction technique and select the learning data. For example, the learning unit 150 may extract only about 20% randomly from the spam pattern and non-spam pattern and select the learning data.

According to one aspect of the present invention, the selected learning data can be utilized for learning SVM (Support Vector Machine), and the spam determining unit 140 receives the pattern of the entire image spam, and based on the selected hyperplane from the learned data And can determine whether the received message is image spam.

Hereinafter, an image spam filtering method according to an embodiment of the present invention will be described.

An image spam filtering method according to an aspect of the present invention can be performed using the above-described image spam filtering apparatus, and will be described in terms of an image spam filtering apparatus.

7 is a flowchart illustrating an image spam filtering method according to an embodiment of the present invention.

Referring to FIG. 7, the image spam filtering device receives a message (710) and determines whether the received message is an image message (720).

If the message is an image message, the image spam filtering apparatus binarizes the image included in the message and converts the image into grayscale (730).

The image spam filtering apparatus extracts LBP (Local Binary Pattern) information from the image converted into the gray scale (740).

The image spam filtering device classifies the extracted LBP information using a Support Vector Machine (SVM) classification algorithm (750).

The image spam filtering device determines whether the message is image spam based on the classified result (760).

The image spam filtering apparatus may analyze the gray level of the converted image and determine the message as image spam if the predetermined number of frequencies is between predetermined levels.

In addition, the image spam filtering apparatus may select some of the patterns extracted from the extracted LBP information as learning data, and may learn the selected learning data through SVM (Support Vector Machine) (770).

The image spam filtering device may determine whether the message is image spam based on a hyperplane of the learned learning data based on a pattern of the entire image spam learned in advance.

The image spam filtering apparatus calculates eLBP (edge-LBP) information by applying a weight to the LBP information for each pixel unit of the transformed image, and classifies the extracted eLBP information using SVM (Support Vector Machine) And determine whether the message is image spam based on the classified result.

The image spam filtering method according to one aspect of the present invention can block image spam of e-mail through a text message through a mobile device and a web account on the Internet.

The image spam filtering method according to one aspect of the present invention can prevent distribution of viruses and malicious programs that are distributed as image spam.

The image spam filtering method according to one aspect of the present invention can increase the blocking rate of image spam and reduce the distribution blocking rate of malicious programs and viruses distributed by bypassing the text based spam filtering system.

The image spam filtering method according to an aspect of the present invention can be applied to a mail server of each portal site without newly developing an existing mailing system.

The image spam filtering method according to one aspect of the present invention is developed as background software of a text messaging service of a smart mobile device and a mobile messenger service, and can easily be mounted and applied to services.

The image spam filtering method according to one aspect of the present invention can also be applied to a vaccine program to prevent malicious software and viruses distributed through image spam.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

110:
120: Image conversion unit
130: LBP extracting unit
140: Spam judging unit
150:
160:

Claims (10)

A message judging unit for judging whether the received message is an image message;
An image converting unit for binarizing the image included in the message and converting the image into grayscale when the message is an image message;
An LBP extracting unit for extracting LBP (Local Binary Pattern) information from the image converted into the gray scale; And
A spam determination unit for classifying the extracted LBP information using a SVM (Support Vector Machine) classification algorithm, and determining whether the message is image spam based on the classified result;
And an image spam filtering device.
The method according to claim 1,
Wherein the spam determination unit comprises:
Analyzing the gray level of the transformed image and determining the message as image spam if it has a predetermined frequency between predetermined levels
Image spam filtering device.
The method according to claim 1,
A learning unit for selecting some of the patterns extracted from the extracted LBP information as learning data and learning the selected learning data through SVM (Support Vector Machine)
Wherein the image spam filtering device further comprises:
The method of claim 3,
Wherein the spam determination unit comprises:
It is determined whether the message is image spam based on a hyperplane of the learned learning data based on a pattern of the entire image spam learned in advance
Image spam filtering device.
The method according to claim 1,
The LBP extractor may calculate edge-LBP information by applying a weight to the LBP information for each pixel unit of the transformed image,
The spam determining unit classifies the extracted eLBP information using a support vector machine (SVM) classification algorithm, and determines whether the message is image spam based on the classified result
Image spam filtering device.
Determining whether the received message is an image message;
If the message is an image message, converting the image included in the message into a gray scale;
Extracting LBP (Local Binary Pattern) information from the image converted into the gray scale; And
Classifying the extracted LBP information using a Support Vector Machine (SVM) classification algorithm, and determining whether the message is image spam based on the classified result
The method comprising the steps of:
The method according to claim 6,
Analyzing the gray level of the transformed image and determining the message as image spam if it has a predetermined frequency between predetermined levels
The method comprising the steps of:
The method according to claim 6,
Selecting a pattern among patterns extracted from the extracted LBP information as learning data; And
Learning the selected learning data through SVM (Support Vector Machine)
The method comprising the steps of:
9. The method of claim 8,
Determining whether the message is image spam based on a hyperplane of the learned learning data based on a pattern of the entire image spam learned in advance;
The method comprising the steps of:
The method according to claim 6,
Calculating eLBP (edge-LBP) information by applying a weight to the LBP information for each pixel unit of the transformed image; And
Classifying the extracted eLBP information using a SVM (Support Vector Machine) classification algorithm, and determining whether the message is image spam based on the classified result
The method comprising the steps of:

Images