DYNAMIC COMBATTING OF SPAM AND PHISHING ATTACKS

• US 20080177841A1
• Filed: 01/19/2007
• Published: 07/24/2008
• Est. Priority Date: 01/19/2007
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Yahoo! Inc. (Apollo Global Management, Inc.)
• Inventors: Sinn, Richard, Libbey, Miles
• Granted Patent: US 8,209,381 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A self training set of robots are configured to proactively search for selective communication abuses over a network. Robots may enter a chat room to proactively send messages. The robots then analyze patterns and/or content of a received message for potential abuse. Robots may also passively reside on/off line without publishing their network address. If a message is received, the message may be interpreted to be SPAM/SPIM. Robots may also perform a variety of other actions, such as access websites, and analyze received messages to determine if the messages indicate abuse. If abuse is detected, information may also be obtained to enable blocking or filtering of future messages from the sender, or access to/from an abusive website. The information also may be used to retrain robots, so that the robots may learn from and share their collective knowledge of abusive actions.

Claims

1. A system for detecting an abusive activity over a network, comprising:

a computer robot (bot) that is configured to perform actions, including;

proactively sending a first message in a chat room;

receiving a response to the first message; and

if the response indicates an abusive activity in the chat room, determining a source of the response, and transmitting the response and the determined source of the response over the network; and

a network device that is configured to perform actions, including;

receiving the response and the determined source of the response;

dynamically revising a filter to block another message based on the response or the determined source; and

dynamically retraining the robot based, in part, on the response, the determined source, and information from the blocking filter.

2. The system of claim 1, wherein the robot is further configured to send another message in a different online messaging application, comprising at least one of an instant messaging, Short Messaging Service, or email.

3. The system of claim 2, wherein the robot is further configured to perform actions, including:

if the response to the other message indicates an abusive activity in the different messaging application, determining a source of the response to the other message, and transmitting the response and the determined source to the network device.

4. The system of claim 1, further comprising:

another robot that is configured to perform actions, including;

changing a status to online for a messaging application without advertising an identifier associated with the other robot;

listening for receipt of a second message; and

if the second message is received, identifying the second message as an abusive message.

5. The system of claim 4, the other robot being configured to perform actions, further comprising:

sending the determined source of the second message to the network device, wherein the network device is further configured to dynamically revise the filter to block messages from the determined source of the second message, and to dynamically retrain at least one robot based on information associated with the second message.

6. The system of claim 1, wherein the network device further comprises an integration service for use in deactivating an account, or revising a filter to block messages.

7. The system of claim 1, wherein the computer robot further comprises at least one of a chat process, an offline messaging process, or an online messaging process.

8. A processor readable medium having computer-executable instructions, wherein the execution of the computer-executable instructions provides for detecting an abusive activity by enabling actions, including:

generating at least one robot that is configured to proactively send a first message within a chat room, to receive and to analyze a response to the first message, and if the response indicates an abusive activity, determining a source of the response;

receiving the response, and the determined source of the response, from the at least one robot;

dynamically revising a filter to block another message based on the determined source or the response; and

dynamically training the at least one robot based on the response and the determined source.

9. The processor readable medium of claim 8, wherein dynamically training the at least one robot, further comprises, configuring the at least one robot to monitor for abusive activity in a different messaging application, based on the response or the determined source.

10. The processor readable medium of claim 8, wherein the at least one robot is further configured to move from the chat room to another chat room and to further proactively send another message within the other chat room to detect abusive activity in the other chat room.

11. The processor readable medium of claim 8, wherein the at least one robot is further configured to move to another messaging application, and without advertising an identifier, listening for another message sent to the at least one robot.

12. The processor readable medium of claim 11, wherein the at least one robot, if further configured such that if the other message is received in the other messaging application, identifying the other message as an abusive activity.

13. The processor readable medium of claim 8, wherein at least one robot is configured to be deactivated based on at least one of a time period being exceeded, or a condition being satisfied.

14. A computer robot for detecting abusive activity within a messaging application over a network, comprising:

deploying passively within a first messaging application, without advertising an identifier;

listening for a message directed to the robot;

if a message is received within the first messaging application, directed to the unadvertised robot'"'"'s identifier;

identifying the message as abusive activity;

determining a source of the message; and

providing the message, and the determined source of the message to a network device for use in filtering another message from the determined source, and to further train the robot to monitor for another message from the determined source in a second messaging application.

15. The robot of claim 14, further comprising:

logging into a chat room;

proactively sending a chat message within the chat room;

receiving a response to the chat message; and

if the response to the chat message indicates abusive activity;

determining a source of the response to the chat message, and

providing the response to the chat message, and the determined source to the network device for use in filtering another message from the determined source of the response to the chat message.

16. The robot of claim 15, wherein the robot is configured to log into a different chat room and to proactively send another chat message.

17. The robot of claim 14, wherein the robot is further configured to become deactivated based in part on satisfaction of a time period or an event.

18. A method of detecting an abusive activity over a network within a messaging application, comprising:

generating a computer robot that is configured to proactively send a first message within a first messaging application, to receive and to analyze a response to the first message, and if the response indicates an abusive activity, determining a source of the response;

dynamically revising a filter to block another message from the determined source or based on the response; and

dynamically training the computer robot based on the response or the determined source, such that the computer robot is enabled to detect another abusive activity based, in part, on the response or the determined source in another messaging application.

19. The method of claim 18, wherein the first messaging application is at least one of a chat room, a website, instant messaging, short messaging service, or email.

20. A modulated data signal configured to include program instructions for performing the method of claim 18.