SHORT MESSAGE SERVICE VALIDATION ENGINE

• US 20140179360A1
• Filed: 12/21/2012
• Published: 06/26/2014
• Est. Priority Date: 12/21/2012
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Inventors: Jackson, Jeffrey A., Carney, Mark D., McKee, Martin W., Baumbach, George G.
• Granted Patent: US 9,277,378 B2
• Time in Patent Office: Days
• US Class Current: 455/466
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

A method, performed by a computer device, may include receiving a Short Message Service (SMS) message. The method may further include analyzing one or more sender parameters associated with the received SMS message to validate the one or more sender parameters; determining whether the one or more sender parameters have been validated based on the analysis; rejecting the SMS message in response to determining that the one or more sender parameters have not been validated; analyzing message content included in the SMS message to validate the message content; determining whether the message content has been validated based on the analysis; rejecting the SMS message in response to determining that the message content has not been validated; and forwarding the SMS message to a recipient, in response to validating the one or more sender parameters and in response to validating the message content.

Claims

1. A method, performed by a computer device, the method comprising:

receiving, by the computer device, a Short Message Service message;

analyzing, by the computer device, one or more sender parameters associated with the received Short Message Service message to validate the one or more sender parameters;

determining, by the computer device, whether the one or more sender parameters have been validated based on the analysis;

rejecting, by the computer device, the Short Message Service message in response to determining that the one or more sender parameters have not been validated;

analyzing, by the computer device, message content included in the Short Message Service message to validate the message content;

determining, by the computer device, whether the message content has been validated based on the analysis;

rejecting, by the computer device, the Short Message Service message in response to determining that the message content has not been validated; and

forwarding, by the computer device, the Short Message Service message to a recipient, in response to validating the one or more sender parameters and in response to validating the message content.

2. The method of claim 1, wherein analyzing the one or more sender parameters includes:

determining whether a first mobile device identifier associated with the Short Message Service message matches a second mobile device identifier associated with the Short Message Service message;

determining whether a first base station identifier associated with the Short Message Service message matches a second base station identifier associated with the first mobile device identifier;

determining whether a packet data network gateway identifier associated with the Short Message Service message matches a second packet data network gateway identifier associated with the first mobile device identifier;

or

determining whether a first location associated with the Short Message Service message matches a second location associated with the first mobile device identifier.

3. The method of claim 1, wherein analyzing the one or more sender parameters includes:

retrieving a Short Message Service gateway identifier from the received Short Message Service message;

determining whether the Short Message Service gateway identifier has been associated with malicious Short Message Service messages; and

rejecting the Short Message Service message in response to determining that the Short Message Service gateway identifier has been associated with malicious Short Message Service messages.

4. The method of claim 1, wherein analyzing the one or more sender parameters includes:

retrieving a Short Message Service gateway identifier from the received Short Message Service message;

determining that the received Short Message Service message has been rejected; and

flagging the Short Message Service gateway identifier as being associated with malicious Short Message Service messages, in response to determining that the received Short Message Service message has been rejected.

5. The method of claim 1, wherein analyzing message content included in the Short Message Service message to validate the message content includes:

determining whether the message content includes content included on a blacklist; and

invalidating the message content in response to determining that the message content includes content included on the blacklist.

6. The method of claim 1, wherein the content included on the blacklist includes at least one of a term or a phrase, a Uniform Resource Identifier, or a sender identifier.

7. The method of claim 1, further comprising:

retrieving a Uniform Resource Identifier from the Short Message Service message;

accessing content using the Uniform Resource Identifier;

performing behavior analysis on the accessed content in a virtual analysis space;

determining whether the Uniform Resource Identifier has been validated based on the behavior analysis; and

rejecting the Short Message Service message in response to determining that Uniform Resource Identifier has not been validated.

8. The method of claim 7, wherein performing behavior analysis on the accessed content in a virtual analysis space includes:

simulating an operating system in the virtual analysis space; and

analyzing the simulated operating system to determine whether the accessed content exhibits malicious behavior with respect to the operating system.

9. The method of claim 7, wherein performing behavior analysis on the accessed content in a virtual analysis space includes:

simulating an application in the virtual analysis space; and

analyzing the simulated application to determine whether the accessed content exhibits malicious behavior with respect to the application.

10. The method of claim 1, further comprising:

identifying a recipient associated with the received Short Message Service message;

obtaining one or more specifications associated with the identified recipient;

determining whether the Short Message Service message satisfies the obtained one or more specifications; and

rejecting the Short Message Service message in response to determining that the Short Message Service message does not satisfy the obtained one or more specifications.

11. The method of claim 1, further comprising:

determining that the received Short Message Service message is associated with a premium rate recipient; and

sending an alert to a sender associated with the received Short Message Service message, in response to determining that the received Short Message Service message is associated with a premium rate recipient.

12. A computer device comprising:

logic configured to;

receive a Short Message Service message;

analyze one or more sender parameters associated with the received Short Message Service message to validate the one or more sender parameters;

determine whether the one or more sender parameters have been validated based on the analysis;

reject the Short Message Service message in response to determining that the one or more sender parameters have not been validated;

analyze message content included in the Short Message Service message to validate the message content;

determine whether the message content has been validated based on the analysis;

reject the Short Message Service message in response to determining that the message content has not been validated; and

forward the Short Message Service message to a recipient, in response to validating the one or more sender parameters and in response to validating the message content.

13. The computer device of claim 12, wherein, when the logic is configured to analyze the one or more sender parameters, the logic is further configured to:

determine whether a first mobile device identifier associated with the Short Message Service message matches a second mobile device identifier associated with the Short Message Service message;

determine whether a first base station identifier associated with the Short Message Service message matches a second base station identifier associated with the first mobile device identifier;

or

determine whether a first location associated with the Short Message Service message matches a second location associated with the first mobile device identifier.

14. The computer device of claim 12, wherein, when the logic is configured to analyze the one or more sender parameters, the logic is further configured to:

retrieve a Short Message Service gateway identifier from the received Short Message Service message;

determine whether the Short Message Service gateway identifier has been associated with malicious Short Message Service messages; and

reject the Short Message Service message in response to determining that the Short Message Service gateway identifier has been associated with malicious Short Message Service messages.

15. The computer device of claim 12, wherein the logic is further configured to:

retrieve a Uniform Resource Identifier from the Short Message Service message;

access content using the Uniform Resource Identifier;

perform behavior analysis on the accessed content in a virtual analysis space;

determine whether the Uniform Resource Identifier has been validated based on the behavior analysis; and

reject the Short Message Service message in response to determining that Uniform Resource Identifier has not been validated.

16. The computer device of claim 15, wherein when the logic is configured to perform the behavior analysis on the accessed content in a virtual analysis space, the logic is further configured to:

simulate at least one of an operating system or an application in the virtual analysis space; and

analyze the simulated at least one of an operating system or an application to determine whether the accessed content exhibits malicious behavior with respect to the operating system.

17. The computer device of claim 12, wherein the logic is further configured to:

identify a recipient associated with the received Short Message Service message;

obtain one or more specifications associated with the identified recipient;

determine whether the Short Message Service message satisfies the obtained one or more specifications; and

reject the Short Message Service message in response to determining that the Short Message Service message does not satisfy the obtained one or more specifications.

18. The computer device of claim 12, wherein the logic is further configured to:

determine that the received Short Message Service message is associated with a premium rate recipient; and

send an alert to a sender associated with the received Short Message Service message, in response to determining that the received Short Message Service message is associated with a premium rate recipient.

19. A non-transitory computer-readable medium, storing instructions executable by one or more processors, the non-transitory computer-readable medium comprising:

one or more instructions to receive a Short Message Service message;

one or more instructions to analyze one or more sender parameters associated with the received Short Message Service message to validate the one or more sender parameters;

one or more instructions to determine whether the one or more sender parameters have been validated based on the analysis;

one or more instructions to reject the Short Message Service message in response to determining that the one or more sender parameters have not been validated;

one or more instructions to analyze message content included in the Short Message Service message to validate the message content;

one or more instructions to determine whether the message content has been validated based on the analysis;

one or more instructions to reject the Short Message Service message in response to determining that the message content has not been validated;

one or more instructions to retrieve a Uniform Resource Identifier from the Short Message Service message;

one or more instructions to access content using the Uniform Resource Identifier;

one or more instructions to perform behavior analysis on the accessed content in a virtual analysis space;

one or more instructions to determine whether the Uniform Resource Identifier has been validated based on the behavior analysis;

one or more instructions to reject the Short Message Service message in response to determining that Uniform Resource Identifier has not been validated; and

one or more instructions to forward the Short Message Service message to a recipient, in response to validating the one or more sender parameters, in response to validating the message content, and in response to validating the Uniform Resource Identifier.

20. The non-transitory computer-readable medium of claim 19, further comprising:

one or more instructions to identify a recipient associated with the received Short Message Service message;

one or more instructions to obtain one or more specifications associated with the identified recipient;

one or more instructions to determine whether the Short Message Service message satisfies the obtained one or more specifications; and

one or more instructions to reject the Short Message Service message in response to determining that the Short Message Service message does not satisfy the obtained one or more specifications.