Systems, Methods and Programs for Detecting Unauthorized Use of Text Based Communications Services

• US 20170026838A1
• Filed: 10/07/2016
• Published: 01/26/2017
• Est. Priority Date: 12/23/2005
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Inventors: Begeja, Lee, Stern, Benjamin J.
• Granted Patent: US 10,097,997 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 40/289 Phrasal analysis, e.g. finite state techniques or chunking
• CPC Class Codes: G10L 17/00 Speaker identification or verification techniques
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

Systems, methods, and programs for generating an authorized profile for a text communication device or account, may sample a text communication generated by the text communication device or account during communication and may store the text sample. The systems, methods, and programs may extract a language pattern from the stored text sample and may create an authorized profile based on the language pattern. Systems, methods, and programs for detecting unauthorized use of a text communication device or account may sample a text communication generated by the device or account during communication, may extract a language pattern from the audio sample, and may compare extracted language pattern of the sample with an authorized user profile.

Claims

1. A method, comprising:

receiving a message;

determining a plurality of deviations, each of the plurality of deviations associated with a respective authorized profile of a plurality of authorized profiles, each of the plurality of deviations being a difference between a language pattern extracted from the message and a language pattern associated with the respective authorized profile;

comparing, by a processor, each of the plurality of deviations with an allowable amount of deviation associated with the respective authorized profile, the allowable amount of deviation based on an amount of samples used in creating the respective authorized profile; and

determining whether the message is an unauthorized user account communication based on the comparing.

2. The method of claim 1, further comprising:

sampling particular messages to provide message samples; and

creating the plurality of authorized profiles using the message samples.

3. The method of claim 2, wherein the creating the plurality of authorized profiles comprises:

grouping the message samples into groups, each of the groups associated with one of a plurality of authorized users; and

creating the plurality of authorized profiles based on the groups.

4. The method of claim 2, wherein the sampling the particular messages to provide the message samples comprises:

sampling a specific portion of the particular messages.

5. The method of claim 2, wherein the sampling the particular messages to provide the message samples comprises:

sampling the particular messages until a standard deviation among language patterns extracted from the message samples is within a predetermined range.

6. The method of claim 2, wherein the sampling the particular messages to provide the message samples comprises:

sampling the particular messages until a number of the message samples sampled reaches a predetermined amount.

7. The method of claim 2, wherein the sampling the particular messages to provide the message samples comprises:

sampling the particular messages until a number of new words or phrases detected per transmission falls below a threshold.

8. The method of claim 2, further comprising:

determining a number of the particular messages that are authored by a user associated with one of the plurality of authorized profiles; and

determining that the user is a primary user based on the number of the particular messages that are authored by the user.

9. The method of claim 1, wherein the determining whether the message is an unauthorized user account communication comprises:

generating an alert indicating that the message is an unauthorized user account communication.

10. The method of claim 9, further comprising:

transmitting the alert to a recipient of the message.

11. The method of claim 9, wherein generating the alert comprises:

generating the alert comprising a location of a device from which the message was received.

12. A computer readable medium storing computer program instructions, which, when executed on a processor, cause the processor to perform operations comprising:

determining a plurality of deviations, each of the plurality of deviations associated with a respective authorized profile of a plurality of authorized profiles, each of the plurality of deviations being a difference between a language pattern extracted from a message and a language pattern associated with the respective authorized profile;

comparing each of the plurality of deviations with an allowable amount of deviation associated with the respective authorized profile, the allowable amount of deviation based on an amount of samples used in creating the respective authorized profile; and

determining whether the message is an unauthorized user account communication based on the comparing.

13. The computer readable medium of claim 12, the operations further comprising:

sampling particular messages to provide message samples; and

creating the plurality of authorized profiles using the message samples.

14. The computer readable medium of claim 13, wherein the creating the plurality of authorized profiles comprises:

grouping the message samples into groups, each of the groups associated with one of a plurality of authorized users; and

creating the plurality of authorized profiles based on the groups.

15. The computer readable medium of claim 13, wherein the sampling the particular messages to provide the message samples comprises:

sampling the particular messages until at least one of;

a standard deviation among language patterns extracted from the message samples is within a predetermined range;

a number of the message samples sampled reaches a predetermined amount; and

a number of new words or phrases detected per transmission falls below a threshold.

16. An apparatus, comprising:

a processor; and

a memory to store computer program instructions, the computer program instructions when executed on the processor cause the processor to perform operations comprising;

receiving a message;

determining a plurality of deviations, each of the plurality of deviations associated with a respective authorized profile of a plurality of authorized profiles, each of the plurality of deviations being a difference between a language pattern extracted from the message and a language pattern associated with the respective authorized profile;

comparing each of the plurality of deviations with an allowable amount of deviation associated with the respective authorized profile, the allowable amount of deviation based on an amount of samples used in creating the respective authorized profile; and

determining whether the message is an unauthorized user account communication based on the comparing.

17. The apparatus of claim 16, the operations further comprising:

sampling particular messages to provide message samples; and

creating the plurality of authorized profiles using the message samples.

18. The apparatus of claim 17, the operations further comprising:

determining a number of the particular messages that are authored by a user associated with one of the plurality of authorized profiles; and

determining that the user is a primary user based on the number of the particular messages that are authored by the user.

19. The apparatus of claim 16, the operations further comprising:

generating an alert indicating that the message is an unauthorized user account communication.

20. The apparatus of claim 19, wherein the generating the alert comprises:

generating the alert comprising a location of a device from which the message was received.