Method to detect spam over internet telephony (SPIT)

• US 8,141,152 B1
• Filed: 12/18/2007
• Issued: 03/20/2012
• Est. Priority Date: 12/18/2007
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Hwang, Lin Yuh-Ing, Lacy, Leroy, Ling, Li
• Primary Examiner(s): SHAN, APRIL YING
• Application Number:
  US11/958,729
• Time in Patent Office: 1,554 Days
• Field of Search: 726/22, 726/15, 726/23, 726/24, 726/25, 379/88.19, 379/88.08, 379/88.22, 713/187, 713/188, 380/243, 380/247, 370/242, 370/351
• US Class Current: 726/22
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

The present invention provides methods, devices, and systems for detecting and filtering SPam over Internet Telephony (SPIT). The invention includes a two level filter. The first level may include a robust audio hash used to filter audio messages based on their audio content and the second level may include a near-duplicate pattern matching algorithm having a number of content filters and an evaluator to aggregate the results from the multiple content filters. By supporting multiple aggregation methods, a more flexible SPIT detection scheme is provided.

Claims

1. A method for filtering unsolicited calls, comprising:

receiving a message addressed to an intended recipient;

extracting, by a microprocessor, a plurality of feature vectors from content of the message, each of the plurality of feature vectors describing message content, wherein at least two of the plurality of feature vectors comprise different threshold distances;

incorporating each of the extracted plurality of feature vectors into feature vectors from content of previously identified spam messages;

calculating a first distance from a first of the plurality of feature vectors to each feature vector in an associated spam feature database;

identifying a first feature vector in the associated spam feature database that is closest to the first of the plurality of feature vectors;

determining the first distance to be a distance from the first identified feature vector to the first of the plurality of feature vectors;

setting the first distance as a first threshold associated with the first of the plurality of feature vectors for determining that other features vectors are similar to the first of the plurality of feature vectors;

calculating a second distance from a second of the plurality of feature vectors to each feature vector in the associated spam feature database;

identifying a second feature vector in the associated spam feature database that is closest to the second of the plurality of feature vectors;

determining the second distance to be a distance from the second identified feature vector to the second of the plurality of feature vectors; and

setting the second distance as a second threshold associated with the second of the plurality of feature vectors for determining that other features vectors are similar to the second of the plurality of feature vectors, wherein the first and second thresholds are different;

comparing, by the microprocessor, the extracted plurality of feature vectors to the feature vectors from the content of the previously identified spam messages;

determining, by the microprocessor, whether each of the extracted plurality of feature vectors are within a threshold distance from at least one spam feature vector; and

applying, by the microprocessor, following rules to results of the determining step;

(i) in an event that each of the extracted plurality of feature vectors are within the threshold distance from at least one spam feature vector, adding the message to a list of previously identified spam messages; and

(ii) in an event that the plurality of feature vectors are not within the threshold distance from at least one spam feature vector, allowing the message to be forwarded to the intended recipient.

2. The method of claim 1, wherein rule (i) applies, the method further comprising indicating to the intended recipient that the received message has been identified as spam, wherein the indicating step comprises at least one of the following (a) deleting the message, (b) notifying the intended recipient that the message has been identified as spam, (c) restricting the message from being forwarded to the intended recipient, and (d) adding the message to a spam message repository and then notifying the intended recipient that the message is stored in the spam message repository.

3. The method of claim 1, further comprising:

aggregating results of the comparison of each of the plurality of feature vectors to determine whether the message is a near-duplicate of a previously identified spam message, wherein the message is a near-duplicate of a previously identified spam message when audio content of the message is perceptually similar to audio content of the previously identified spam message.

4. The method of claim 1, further comprising:

creating a digest from content of the message;

comparing the digest of the message to digests from content of previously identified spam messages;

determining whether the digest of the message is equal to a digest of a previously identified spam message within a predetermined threshold; and

performing one of the following;

(i) in an event that the digest of the message is equal to the digest of a previously identified spam message within a predetermined threshold, adding the message to the list of previously identified spam messages; and

(ii) in an event that the digest of the message is not equal to the digest of a previously identified spam message within a predetermined threshold, allowing the message to be forwarded to the intended recipient.

5. The method of claim 4, wherein creating a digest from content of the message comprises generating a robust hash of the audio content of the message.

6. The method of claim 5, wherein creating a digest comprises:

dividing the audio content of the message into audio segments of predetermined length;

framing each audio segment;

applying a frequency transform function to each framed audio segment;

selecting frequency bands; and

extracting a plurality of hashes based on the selected frequency bands, wherein the hashes each represent a portion of the audio content of the message in the frequency domain.

7. A non-transitory computer readable medium comprising processor executable instructions configured to perform the method of claim 1.

8. A system for filtering unsolicited calls, comprising:

memory including instructions and a microprocessor configured to execute the instructions stored in memory, the instructions when executed by the microprocessor;

receiving a message addressed to an intended recipient;

extracting, a plurality of feature vectors from content of the message, each of the plurality of feature vectors describing message content, wherein at least two of the plurality of feature vectors comprise different threshold distances;

incorporating each of the extracted plurality of feature vectors into feature vectors from content of previously identified spam messages, calculating a first distance from a first of the plurality of feature vectors to each feature vector in an associated spam feature database, identifying a first feature vector in the associated spam feature database that is closest to the first of the plurality of feature vectors, determining the first distance to be a distance from the first identified feature vector to the first of the plurality of feature vectors, setting the first distance as a first threshold associated with the first of the plurality of feature vectors for determining that other features vectors are similar to the first of the plurality of feature vectors, calculating a second distance from a second of the plurality of feature vectors to each feature vector in the associated spam feature database, identifying a second feature vector in the associated spam feature database that is closest to the second of the plurality of feature vectors, determining the second distance to be a distance from the second identified feature vector to the second of the plurality of feature vectors, and setting the second distance as a second threshold associated with the second of the plurality of feature vectors for determining that other features vectors are similar to the second of the plurality of feature vectors, wherein the first and second thresholds are different;

comparing, the extracted plurality of feature vectors to the feature vectors from the content of the previously identified spam messages;

determining whether each of the extracted plurality of feature vectors are within a threshold distance from at least one spam feature vector; and

applying following rules;

(i) in an event that each of the extracted plurality of feature vectors are within the threshold distance from at least one spam feature vector, adding the message to a list of previously identified spam messages; and

(ii) in an event that the plurality of feature vectors are not within the threshold distance from at least one spam feature vector, allowing the message to be forwarded to the intended recipient.

9. The system of claim 8, wherein the first threshold and second threshold are further defined by bit error rate.

10. The system of claim 8, comprising additional instructions when executed by the microprocessor:

providing an indication that the extracted at least one feature vector is within the threshold distance from the at least one feature vector identified as spam.

11. The system of claim 8, comprising additional instructions when executed by the microprocessor:

extracting and examining different feature vectors from the content of the message, and aggregating results to determine whether the received message comprises spam, and wherein the results are aggregated according to at least one of an AND, OR, and VOTE fashion.

12. The system of claim 8, further comprising additional instructions when executed by the microprocessor:

create creating a digest from the content of the message, compare the digest of the content of the message to digests from the content of previously identified spam messages, and determine whether the digest of the content of the message is equal to one of the digests of the content of the previously identified spam messages within a predetermined threshold.

13. The system of claim 12, further comprising additional instructions when executed by the microprocessor:

creating the digest from the content of the message by dividing the message into segments of predetermined length, framing each segment, applying a frequency transform function to each framed segment, selecting frequency bands, and extracting a plurality of hashes based on the selected frequency bands, wherein the hashes each represent a portion of the content of the message in a frequency domain, and adding the message to the list of previously identified spam messages in an event that the digest of the content of the message equal to one of the digests of the content of the previously identified spam messages within a predetermined threshold.

14. The system of claim 13, wherein the predetermined threshold is defined by at least one of the following parameters:

(i) bit error rate;

(ii) percentage of hashes in the incoming message equal to a known spam hash within a predetermined threshold; and

(iii) number of spam messages with hashes equal to the hashes of the incoming message within a predetermined threshold.

15. The system of claim 12, further comprising additional instructions when executed by the microprocessor:

removing noise from the message.

16. The system of claim 8, wherein the message is stored for retrieval on a server and further comprising additional instructions when executed by the microprocessor:

analyzing and deleting the message on the server.

17. The system of claim 8, wherein the message is a real-time communication and further comprising additional instructions when executed by the microprocessor:

analyzing a media channel carrying the content of the message.