System and method for fast and accurate detection of SMS spam numbers via monitoring grey phone space

• US 9,357,362 B2
• Filed: 05/02/2014
• Issued: 05/31/2016
• Est. Priority Date: 05/02/2014
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Jin, Yu, Skudlark, Ann E., Jiang, Nan
• Primary Examiner(s): LETT, THOMAS J
• Application Number:
  US14/268,025
• Publication Number:
  US 20150319586A1
• Time in Patent Office: 760 Days
• Field of Search: 455/466, 706/45
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 2101/618 Details of network addresses
• CPC Class Codes: H04L 2101/65 Telephone numbers
• CPC Class Codes: H04L 2101/654 International mobile subscriber identity [IMSI] numbers
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A method and system for identifying short message service (SMS) spammers identifies senders as spammers by determining that the senders are sending SMS messages to devices included in a grey phone space. Devices in the grey phone space are identified using various methods including an analysis of call detail records. A grey ratio for a sender is determined as a ratio of messages sent to grey phone numbers by the sender to messages sent to all phone numbers by the sender. A sender is identified based on a difference between the grey ratio for the sender and a second grey ratio being above a threshold.

Claims

1. A method comprising:

receiving, by a server, a short messaging service text message associated with an originating number and a terminating number;

retrieving, by the server, electronic call records associated with the originating number;

comparing, by the server, the electronic call records associated with the originating number to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a device lacking a telephony capability to receive short messaging service text messages;

determining, by the server, a match between the electronic call records and a grey phone number in the electronic list of grey phone numbers;

determining, by the server in response to the match, the originating number has previously sent a previous text message to the grey phone number known to lack the telephony capability to receive the short messaging service text messages; and

identifying, by the server, the originating number as a spammer based on the previous text message previously sent to the grey phone number known to lack the telephony capability to receive the short messaging service text messages.

2. The method of claim 1, further comprising determining a grey ratio associated with the originating number.

3. The method of claim 2, further comprising comparing the grey ratio to a threshold.

4. The method of claim 1, further comprising determining all terminating numbers having an association with the originating number.

5. The method of claim 1, further comprising determining the terminating number is associated with a data only device.

6. The method of claim 5, wherein the determining the terminating number is associated with the data only device is based on an international mobile equipment identity number.

7. The method of claim 1, further comprising periodically comparing the electronic call records associated with the originating number to the entries in the electronic list of grey phone numbers.

8. A system, comprising:

a processor; and

a memory storing computer program instructions that when executed cause the processor to perform operations, the operations comprising;

receiving a short messaging service text message associated with an originating number and a terminating number;

retrieving electronic call records associated with the originating number;

comparing the electronic call records associated with the originating number to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a device lacking a capability to receive short messaging service text messages;

determining a match between the electronic call records and a grey phone number in the electronic list of grey phone numbers;

determining, in response to the match, the originating number has previously sent a previous text message to the grey phone number known to lack the capability to receive the short messaging service text messages; and

identifying the originating number as a spammer based on the previous text message previously sent to the grey phone number known to lack the capability to receive the short messaging service text messages.

9. The system of claim 8, wherein the operations further comprise determining a grey ratio associated with the originating number.

10. The system of claim 9, wherein the operations further comprise comparing the grey ratio to a threshold.

11. The system of claim 8, wherein the operations further comprise determining terminating numbers having associations with the originating number.

12. The system of claim 8, wherein the operations further comprise determining the terminating number is associated with a data only device.

13. The system of claim 12, wherein the operations further comprise determining the terminating number is associated with an international mobile equipment identity number.

14. The system of claim 8, wherein the operations further comprise periodically comparing the electronic call records associated with the originating number to the entries in the electronic list of grey phone numbers.

15. A memory device storing instructions which when executed cause a processor to perform operations, the operations comprising:

receiving a short messaging service text message associated with an originating number and a terminating number;

retrieving electronic call records associated with the originating number;

comparing the electronic call records associated with the originating number to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a device lacking a capability to receive short messaging service text messages;

determining a match between the electronic call records and a grey phone number in the electronic list of grey phone numbers;

determining, in response to the match, the originating number has previously sent a previous text message to the grey phone number known to lack the capability to receive the short messaging service text messages; and

identifying the originating number as a spammer based on the previous text message previously sent to the grey phone number known to lack the capability to receive the short messaging service text messages.

16. The memory device of claim 15, wherein the operations further comprise determining a grey ratio associated with the originating number.

17. The memory device of claim 16, wherein the operations further comprise comparing the grey ratio to a threshold.

18. The memory device of claim 15, wherein the operations further comprise determining terminating numbers having associations with the originating number.

19. The memory device of claim 15, wherein the operations further comprise determining the terminating number is associated with a data only device.

20. The memory device of claim 19, wherein the operations further comprise determining the terminating number is associated with a data only service based on an international mobile equipment identity number associated with the device.