IDENTIFYING ABUSIVE MOBILE MESSAGES AND ASSOCIATED MOBILE MESSAGE SENDERS

• US 20120028606A1
• Filed: 07/27/2010
• Published: 02/02/2012
• Est. Priority Date: 07/27/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Bobotek, Alexander
• Granted Patent: US 8,892,136 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/48 Message addressing, e.g. address format or anonymous messages, aliases
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Systems, methods, and devices that identify abusive mobile messages and associated abusive mobile communication device users are presented. A core network can comprise a message abuse detector component (MADC) that can selectively or randomly monitor or sample mobile messages communicated in the core network. The MADC can evaluate origination and destination address information and can identify abusive mobile messages and associated abusive mobile message senders based at least in part on the respective address information and predefined message abuse criteria. The MADC also can distinguish between spam mobile messages, subscription mobile messages, harassing mobile messages, and other mobile messages, and can identify and implement a desired response (e.g., automated response) to the abusive mobile message. To facilitate identifying abusive mobile messages, the MADC also can analyze history and reputation associated with the origination address, reputation of the address reporting an abusive message, message content, etc.

Claims

1. A system that facilitates identification of an abusive mobile message sender or abusive mobile messages, comprising:

a core network that is configured to facilitate communication of mobile messages between mobile communication devices in a communication network environment; and

a message abuse detector component (MADC) that is configured to sample a portion of the mobile messages over a predefined period of time and identify the abusive mobile message sender from the portion of the mobile messages based at least in part on evaluation of respective originating addresses and respective termination addresses of respective mobile messages in the sampled portion of the mobile messages, in accordance with predefined message abuse criteria.

2. The system of claim 1, wherein the MADC is further configured to count a number of mobile messages, in the sampled portion of the mobile messages, associated with a respective originating address, and for at least a portion of the originating addresses identified in the sampled portion of the mobile messages, identifying at least one respective originating address as a high-count mobile message sender when the number of mobile messages associated with the at least one originating address is at or above a predefined high-count threshold number of mobile messages applicable for the given period of time.

3. The system of claim 2, wherein the MADC is further configured to, for the at least one originating address, count a number of unique termination addresses identified in a subset of mobile messages associated with the at least one originating address and in the portion of the mobile messages, and calculate a ratio of the number of unique termination addresses to the number of mobile messages associated with the at least one originating address.

4. The system of claim 3, wherein the MADC is further configured to at least one of:

identify the at least one originating address as the abusive mobile message sender and further identify at least one mobile message from the at least one originating address as an abusive mobile message, when the ratio is at or above a predefined threshold ratio level indicative of mobile message abuse in accordance with the predefined message abuse criteria, or

generate an abuse indicator that signifies that mobile messaging by the at least one originating address is indicative of the at least one originating address being an abusive mobile message sender and further identify the at least one mobile message as an abusive mobile message, when the ratio is at or above a predefined threshold ratio level indicative of mobile message abuse.

5. The system of claim 4, wherein, at least when the abuse indicator is generated, the MADC is further configured to perform an in-depth evaluation to facilitate identification of whether the at least one originating address is the abusive mobile message sender and further identify the at least one mobile message from the at least one originating address as an abusive mobile message, and wherein the in-depth evaluation comprising evaluation of the ratio and at least one of historical information, reputation, at least one call data record, content of at least one mobile message, at least one honeypot record, or at least one abuse report, associated with the at least one originating address, in accordance with the predefined message abuse criteria.

6. The system of claim 1, wherein the MADC is further configured to at least one of randomly or selectively sample the portion of the mobile messages, wherein full or selective sampling of the portion of the mobile messages is at least performed in response to receipt of at least one abuse report from at least one mobile communication device, wherein the at least one abuse report indicates that an abusive mobile message was received from an originating address, when a predefined threshold number of abuse reports associated with the originating address is received by the MADC.

7. The system of claim 1, wherein the MADC is further configured to automatically execute zero or at least one abuse management action in response to the identification of the abusive mobile message sender.

8. The system of claim 7, wherein the at least one abuse management action comprises at least one of blockage of mobile messages from an originating address identified as the abusive mobile message sender, shutdown of service of a mobile communication device associated with the originating address, shutdown of a Subscriber Identity Module (SIM) of the mobile communication device associated with the originating address, quarantine of mobile messages sent from the mobile communication device associated with the originating address, sideline of mobile messages sent from the mobile communication device associated with the originating address, credit a wireless service account associated with a destination mobile communication device that received at least one abusive mobile message from the abusive mobile message sender, blacklist the originating address, block one or more mobile messages with similar or identical content that are sent from one or more other sources, or communicate at least information relating to identification of the abusive mobile message sender to at least one other entity.

9. The system of claim 1, wherein the MADC is further configured to filter one or more mobile messages having a specified termination address associated with a specified mobile communication device to prevent delivery of the one or more mobile messages to the specified mobile communication device based at least in part on one or more filters selected to be applied at least to mobile messages sent to the specified termination address.

10. The system of claim 1, wherein the MADC is further configured to apply at least one hashing technique to at least one mobile message in the portion of the mobile messages and generate hash information that is representative of content of the at least one mobile message, to facilitate identification as to whether the at least one mobile message is an abusive mobile message sent from the abusive mobile message sender.

11. The system of claim 1, wherein the MADC is further configured to receive at least one of an abuse report from a mobile communication device or an appeal from the mobile communication device, wherein the abuse report comprises information that indicates that at least one mobile message received by the mobile communication device is an abusive mobile message, and wherein the appeal comprises information that indicates that at least one of a decision made or an action performed by the MADC or an entity associated with the MADC is in error, and is further configured to automatically execute at least one action in response to receipt of the at least one of the abuse report or the appeal.

12. The system of claim 1, wherein at least one mobile message of the mobile messages is at least one of a short message service (SMS) message, an enhanced message service (EMS) message, a multimedia messaging service (MMS) message, an instant message communicated via a mobile communication device, or a Session Initiation Protocol (SIP) message.

13. A method that facilitates identifying an abusive mobile message, comprising:

evaluating respective address information respectively associated with mobile messages in a subset of mobile messages selected, over a given period of time, from a mobile message stream communicated via a core network; and

identifying at least one mobile message of the subset of mobile messages as one of an abusive mobile message or a non-abusive mobile message based at least in part on the respective address information and predefined message abuse criteria.

14. The method of claim 13, further comprising:

for each originating address respectively associated with the respective mobile messages in the subset of mobile messages,

counting a number of mobile messages associated with the originating address;

comparing the number of mobile messages to a predefined high-count threshold number of mobile messages applicable for the given period of time; and

identifying the originating address as being associated with a high-count mobile message sender when the number of mobile messages is at or above the predefined high-count threshold number of mobile messages.

15. The method of claim 14, further comprising:

for each originating address identified as being associated with a high-count mobile message sender,

counting a number of unique termination addresses for the originating address;

computing a ratio of the number of unique termination addresses to the number of mobile messages associated with the originating address;

identifying the originating address as being associated with an abusive mobile message sender that sent the abusive mobile message when the ratio is at or over a predefined threshold ratio level indicative of abusive mobile messaging in accordance with the predefined message abuse criteria and

automatically executing at least one abuse management action in response to identifying the originating address as being associated with the abusive mobile message sender that sent the abusive mobile message.

16. The method of claim 14, further comprising:

for each originating address identified as being associated with a high-count mobile message sender,

generating an abuse indicator when a ratio of the number of unique termination addresses to the number of mobile messages associated with the originating address has a value that is at or over a predefined threshold ratio level indicative of abusive mobile messaging in accordance with the predefined message abuse criteria;

obtaining additional information relating to mobile messaging associated with the originating address, the additional information comprising at least one of historical information, reputation, at least one call data record, content of at least one mobile message, at least one honeypot record, or at least one abuse report, associated with the originating address;

evaluating the ratio and the additional information; and

identifying the at least one mobile message of the subset of mobile messages associated with the originating address as one of an abusive mobile message or a non-abusive mobile message, based at least in part on the evaluation of the ratio and the additional information, in accordance with the predefined message abuse criteria.

17. The method of claim 13, further comprising:

generating an abuse report in response to receiving an abuse report indicator in relation to a received mobile message associated with an originating address associated with a wireless communication device, wherein the abuse report comprises information comprising at least one of originating address of a sender of the mobile message, termination address of a recipient of the mobile message, time of the mobile message, indicator that the mobile message is abusive, or a reason that the mobile message is abusive; and

transmitting the abuse report.

18. The method of claim 17, further comprising:

automatically performing evaluation of the abuse report in response to receiving the abuse report; and

automatically performing evaluation of mobile messaging associated with the originating address to facilitate identifying whether the mobile message is an abusive mobile message, when predefined minimum threshold criteria for triggering evaluation are met.

19. The method of claim 13, further comprising:

identifying the at least one mobile message as a subscription-related mobile message based at least in part on the predefined message abuse criteria; and

automatically executing at least one specified unsubscribing action in response to identifying the at least one mobile message as the subscription-related mobile message, wherein the at least one specified unsubscribing action comprising at least one of;

recommending to a subscription service provider that a subscription be canceled, on behalf of a subscriber,

notifying the subscriber that the at least one mobile message is subscription related and recommending that the subscriber contact the subscription service provider to cancel the subscription if the subscriber does not desire further mobile messages or service from the subscription service provider, or

transmitting a cancellation message to the subscription service provider to cancel the subscription of the subscriber on behalf of the subscriber.

20. A system that facilitates reporting a mobile message and associated mobile message sender as abusive, comprising:

an abuse reporter component that is configured to receive information that indicates an abuse report is to be generated in relation to at least one mobile message received from an originating mobile communication device to indicate that the at least one mobile message is an abusive mobile message, and transmit the abuse report to a message abuse detector component (MADC), wherein the abuse reporter component is associated with a destination mobile communication device that is configured to receive the at least one mobile message from the originating mobile communication device; and

an appeal component that is configured to receive information that indicates an appeal is to be generated in response to action taken by at least one of the MADC or an entity associated with the MADC in relation to at least one of the destination mobile communication device or the originating mobile communication device, and transmit the appeal to the MADC.