Image spam clustering: an unsupervised approach

• Authors: Wei-Bang chen;Chengcui Zhang
• Venue: MiFor '09 Proceedings of the First ACM workshop on Multimedia in forensics
• Year: 2009

We propose an unsupervised image clustering framework for revealing the common origins, i.e. the spam gangs, of unsolicited emails. In particular, we target email spam with image attachments because spam information is harder to extract due to information hiding enabled by various image obfuscation techniques. To identify spam gangs, we observe that spam images from the same source are usually composed of visually similar elements which are arranged and altered in many different ways in order to trick the spam filter. We propose to infer spam images originated from the same spam gang by investigating spam email similarity in terms of their visual appearance and editing style. In particular, a data mining technique based on unsupervised image clustering is proposed in this paper to solve this problem. This is achieved by first dividing a spam image into different areas/segments, including texts, foreground graphic illustrations, and background areas. The proposed framework then extracts characteristic visual features from segmented areas, including text layout, visual features of foreground graphic illustrations and its spatial layout, and background texture features. In the clustering stage, all spam images are first categorized as illustrated images and text mainly images according to the existence of foreground illustration objects. Then illustrated images are clustered based on the color and/or foreground layout, while text mainly images are clustered based on the text layouts and/or background textures. A novel unsupervised ranked clustering algorithm is proposed for feature fusion, which is used in combination with the traditional hierarchical clustering algorithm for clustering. We test the proposed approach using different settings and combinations of features and measure the overall performance with V-measure.