Employing report ratios for intelligent mobile messaging classification and anti-spam defense

• US 8,924,488 B2
• Filed: 09/13/2010
• Issued: 12/30/2014
• Est. Priority Date: 07/27/2010
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Bobotek, Alexander
• Primary Examiner(s): Htun, San
• Assistant Examiner(s): Navar, Erica
• Application Number:
  US12/880,945
• Publication Number:
  US 20120030293A1
• Time in Patent Office: 1,569 Days
• Field of Search: 379/88.19, 379/88.22, 455/410, 455/411, 455/412.1, 455/412.2, 455/414.1, 455/414.3, 455/415, 455/417, 455/445, 455/466, 709/206, 709/207
• US Class Current: 709/206
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication

Abstract

Systems, methods, and devices that classify mobile messages and associated mobile message senders are presented. A communication network can comprise a message abuse detector component (MADC) that evaluates a mobile message, for example, labeled as abusive in an abuse report. The MADC can evaluate information relating to the abuse report, wherein the evaluations can include an abuse-report-hash-ratio, an abuse-report-sender-ratio, correlation of mobile message content to known spam content or non-spam content, and/or evaluation of reputation of the mobile message sender or abuse report sender, etc. Based at least in part on the evaluation, the MADC can classify mobile message as spam, subscription related, or as another type of mobile message, and can identify, select, and execute (e.g., automatically) a desired abuse management action(s) based at least in part on the evaluation and predefined message abuse criteria.

Claims

1. A system, comprising:

a memory to store executable instructions; and

a processor, coupled to the memory, that facilitates execution of the executable instructions to perform operations, comprising;

facilitating communication of a mobile message from a first communication device to a second communication device via a communicator component of a communication network, wherein an originating address of the mobile message is associated with the first communication device;

evaluating information relating to the mobile message to facilitate determining a first evaluation result that facilitates determining whether the mobile message is an abusive message and a second evaluation result that facilitates determining whether the mobile message is associated with a subscription;

determining a result value based on a ratio, over a defined period of time, of a first number of distinct termination addresses in a second number of mobile messages sent from the originating address associated with the first communication device to the second number of mobile messages sent from the originating address to facilitate the determining of whether the mobile message is related to the subscription based on the second evaluation result that comprises the result value;

classifying whether the mobile message is the abusive message, based on the first evaluation result and the second evaluation result, in accordance with a defined message abuse criterion; and

in response to determining that a ratio value of an abuse-report-hash-ratio result is within a defined range of ratio values, and in response to classifying the mobile message as being the abusive message based on the first evaluation result and the second evaluation result, filtering mobile messages associated with at least the originating address from which the mobile message was sent to facilitate blocking delivery of the mobile messages to a set of communication devices, comprising the second communication device.

2. The system of claim 1, wherein the operations further comprise hashing the mobile message to generate a first hash value that is representative of a first portion of content of the mobile message based on a defined hash technique and the defined message abuse criterion.

3. The system of claim 2, wherein the operations further comprise:

determining an overall number of mobile messages, over the defined period of time, that are represented by the first hash value;

determining a number of abuse-reported mobile messages, of the overall number of mobile messages, for which an abuse report has been received; and

determining an abuse-report-hash ratio, based on another ratio of the number of abuse-reported mobile messages to the overall number of mobile messages, to generate the abuse-report-hash ratio result.

4. The system of claim 3, wherein the operations further comprise classifying whether the mobile message is an abusive spam mobile message, and whether the originating address associated with the first communication device is an abusive mobile message sender, based on the abuse-report-hash ratio result, wherein the abuse-report-hash ratio result being determined to comprise the ratio value that is within the defined range of ratio values that is indicative of the mobile message being the abusive spam mobile message and the originating address being the abusive mobile message sender.

5. The system of claim 4, wherein the filtering the mobile messages associated with at least the originating address from which the mobile message was sent the operations further comprise comprises filtering the mobile messages associated with the abusive mobile message sender to facilitate blocking the delivery of the mobile messages to the set of communication devices, comprising the second communication device, in response to determining that the ratio value is within the defined range of ratio values.

6. The system of claim 4, wherein the operations further comprise, in response to determining that the ratio value is not within the defined range ratio values,

determining whether the result value satisfies a defined threshold value;

and

classifying the mobile message as being related to the subscription in response to the result value being determined to satisfy the defined threshold value.

7. The system of claim 2, wherein the operations further comprise:

evaluating the first hash value and a known spam hash value;

determining whether there is a correlation between the first hash value and the known spam hash value; and

classifying the mobile message based on the determining whether there is the correlation between the first hash value and the known spam hash value.

8. The system of claim 1, wherein the operations further comprise:

determining a number of abusive messages that are indicated to have been sent from the originating address associated with the first communication device, based on a set of abuse reports, wherein the set of abuse reports are received from a set of addresses associated with the set of communication devices over the defined period of time;

determining a total number of mobile messages sent from the originating address associated with the first communication device;

determining an abuse ratio based on another ratio of reported number of abusive messages sent from the originating address associated with the first communication device to the total number of mobile messages sent from the originating address associated with the first communication device to generate an abuse ratio result; and

classifying whether the mobile message is the abusive message based on a comparison result of a comparison of a value of the abuse ratio result to a defined range of abuse ratio values.

9. The system of claim 1, wherein the operations further comprise executing an abuse management action in response to classifying the mobile message as being the abusive message.

10. The system of claim 9, wherein the executing the abuse management action comprises discontinuing a messaging service associated with the first communication device.

11. The system of claim 1, wherein the operations further comprise filtering a set of mobile messages associated with a termination address associated with the second communication device, based on a filter selected to be applied to the set of mobile messages sent to the termination address, to facilitate preventing delivery of a subset of the set of mobile messages to the second communication device.

12. A method, comprising:

evaluating, by a system comprising a processor, information relating to a mobile message associated with an originating address associated with a first communication device to facilitate determining a first evaluation result that facilitates identifying whether the mobile message is an abusive message and determining a second evaluation result that facilitates identifying whether the mobile message is associated with a subscription, wherein the mobile message is associated with a destination address associated with a second communication device;

determining, by the system, a result value, for a defined period of time, based on a ratio of a first number of distinct termination addresses in a second number of mobile messages sent from the originating address to the second number of mobile messages sent from the originating address to facilitate the identifying whether the mobile message is associated with the subscription based on the second evaluation result that comprises the result value;

classifying, by the system, whether the mobile message is the abusive message, based on the first evaluation result and the second evaluation result, in accordance with a defined message abuse criterion; and

in response to determining that a ratio value of an abuse-report-hash-ratio result is within a defined range of ratio values, and in response to classifying the mobile message as being the abusive message based on the first evaluation result and the second evaluation result, filtering, by the system, mobile messages associated with at least the originating address from which the mobile message was sent to facilitate preventing delivery of the mobile messages to a set of communication devices, comprising the second communication device.

13. The method of claim 12, further comprising:

executing, by the system, an abuse management action in response to classifying the mobile message as being the abusive message, wherein abuse management action comprises crediting an account associated with the second communication device for a cost relating to the mobile message.

14. The method of claim 12, further comprising:

hashing, by the system, the mobile message; and

generating, by the system, a hash value based on the hashing of the mobile message.

15. The method of claim 14, further comprising:

determining, by the system, an overall number of mobile messages, for the defined period of time, that are represented by the hash value, in response to an abuse report received from the second communication device;

determining, by the system, a number of abuse-reported mobile messages, from the overall number of mobile messages, that are identified as abusive in a set of abuse reports;

determining, by the system, another ratio of the number of abuse-reported mobile messages to the overall number of mobile messages; and

generating, by the system, the abuse-report-hash ratio result based on the other ratio.

16. The method of claim 14, further comprising:

comparing, by the system, the hash value to known spam content; and

classifying, by the system, whether the mobile message is the abusive message based on whether the hash value is a match to the known spam content.

17. The method of claim 14, further comprising:

receiving, by the system, an abuse report from the second communication device, wherein the abuse report indicates the mobile message is abusive;

classifying, by the system, the mobile message as being associated with the subscription based on the first evaluation result and the second evaluation result, wherein the second evaluation result indicates that the mobile message is associated with the subscription;

determining, by the system, that mobile messages associated with the subscription are not to be sent to the second communication device; and

facilitating, by the system, unsubscribing the second communication device from the subscription in response to the classifying of the mobile message as being associated with the subscription and the determining that the mobile messages associated with the subscription are not to be sent to the second communication device.

18. The method of claim 12, further comprising:

receiving, by the system, an abuse report from the second communication device;

identifying, by the system, a reputation value associated with the second communication device;

applying, by the system, the reputation value to a value representative of the abuse report to facilitate weighting the value representative of the abuse report to facilitate generating a weighted value of the abuse report; and

generating, by the system, the weighted value of the abuse report in response to the applying of the reputation value to the value representative of the abuse report, wherein the weighted value of the abuse report facilitates the classifying of the mobile message.

19. A non-transitory computer-readable storage medium storing computer-executable instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:

evaluating information relating to a mobile message associated with an originating address associated with a first communication device to facilitate determining a first evaluation result that facilitates identifying whether the mobile message is an abusive message and determining a second evaluation result that facilitates identifying whether the mobile message is associated with a subscription, wherein the mobile message is associated with a destination address associated with a second communication device;

over a defined period of time, determining a result value based on a ratio of a number of distinct termination addresses in another number of mobile messages sent from the originating address to the other number of mobile messages sent from the originating address to facilitate the identifying whether the mobile message is associated with the subscription based on the second evaluation result that comprises the result value;

determining whether the mobile message is the abusive message, based on the first evaluation result and the second evaluation result, in accordance with a defined message abuse criterion; and

in response to determining that a ratio value of an abuse-report-hash-ratio result is within a defined range of ratio values, and in response to determining that the mobile message is the abusive message based on the first evaluation result and the second evaluation result, filtering mobile messages associated with at least the originating address from which the mobile message was sent to facilitate blocking delivery of the mobile messages to a set of communication devices, comprising the second communication device.

20. The non-transitory computer-readable storage medium of claim 19, wherein the operations further comprise:

hashing the mobile message;

generating a hash value based on the hashing of the mobile message;

comparing the hash value to a spam hash value associated with known spam content; and

classifying whether the mobile message is the abusive message based on whether the hash value is a match to the spam hash value.