Proofpoint, Inc.

Yanyan Yang

John Gardiner Myers

Scott R Panzer

Greg Wittel

Steven Lewis

A method is described that includes comparing a characteristic of an image to stored characteristics of spam images. The method also includes generating a signature of the present image. The method further includes comparing the signature of the present image to stored signatures of spam images. The method also includes determining the spam features corresponding to the stored signatures of spam images that match the signature of the present image.

Apparatus and method for detecting images within spam

A system and method are described for using different types of image fingerprints to detect spam. Specifically, one embodiment of the invention dynamically calculates both an image-specific signature (e.g., MD5 checksum) and a generic signature for each image and, if a specified number of images have the same generic signature but different image-specific signatures, then a feature is fired within a spam engine to indicate that the images are spam. By way of example, a computer-implemented method is described for detecting spam images within a stream of messages comprising: generating generic signatures and image-specific signatures for images within the stream of messages; determining if two or more images with matching generic signatures have different image-specific signatures; and updating a spam filtering engine to include the matching generic signatures if the number of images with matching generic signatures but different image-specific signatures reach a specified threshold value.

Apparatus and method for performing spam detection and filtering using an image history table

A method is described that includes converting the present image of resolution N to resolution M, M being less than N. The method also includes generating a signature of the present converted image. The method further includes comparing the signature of the present converted image to stored signatures of converted spam images, the converted spam images being of resolution M. The method also includes determining spam features corresponding to the stored signatures of converted spam images that match the signature of the present converted image.

A system and method are described for performing a correlative statistical analysis on a stream of email messages to identify new spam campaigns. For example, a method according to one embodiment of the invention comprises: extracting a series of patterns from a stream of incoming email messages; performing a correlation between the patterns to identify recurring patterns within the stream of email messages over a specified time period; dynamically updating a spam filtering engine to include a particular recurring pattern if the number of times the particular recurring pattern is detected within the specified time period is above a first specified threshold value.

Growing community of inventors

Sunnyvale, CA, United States of America

Yanyan Yang