System and method for fast accurate detection of SMS spam numbers via monitoring grey phone space

• US 9,572,004 B2
• Filed: 03/24/2016
• Issued: 02/14/2017
• Est. Priority Date: 05/02/2014
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Jin, Yu, Skudlark, Ann E., Jiang, Nan
• Primary Examiner(s): LETT, THOMAS J
• Application Number:
  US15/079,577
• Publication Number:
  US 20160205528A1
• Time in Patent Office: 327 Days
• Field of Search: 455/406
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 2101/618 Details of network addresses
• CPC Class Codes: H04L 2101/65 Telephone numbers
• CPC Class Codes: H04L 2101/654 International mobile subscriber identity [IMSI] numbers
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A method and system for identifying short message service (SMS) spammers identifies senders as spammers by determining that the senders are sending SMS messages to devices included in a grey phone space. Devices in the grey phone space are identified using various methods including an analysis of call detail records. A grey ratio for a sender is determined as a ratio of messages sent to grey phone numbers by the sender to messages sent to all phone numbers by the sender. A sender is identified based on a difference between the grey ratio for the sender and a second grey ratio being above a threshold.

Claims

1. A method comprising:

comparing, by a system including a processor, electronic records associated with an originating number of a short messaging service text message to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a device lacking a capability to receive short messaging service text messages;

determining, by the system, a match between the electronic records and a grey phone number in the electronic list of grey phone numbers;

determining, by the system in response to the match, that the originating number has previously sent a previous text message to the grey phone number known to lack the capability to receive the short messaging service text messages; and

identifying, by the system, the originating number as a spammer based on the previous text message previously sent to the grey phone number known to lack the capability to receive the short messaging service text messages.

2. The method of claim 1, further comprising determining a grey ratio associated with the originating number.

3. The method of claim 2, further comprising comparing the grey ratio to a threshold.

4. The method of claim 1, further comprising determining all terminating numbers having an association with the originating number.

5. The method of claim 1, further comprising determining that a terminating number of the short messaging service text message is associated with a data-only device.

6. The method of claim 5, wherein the determining that the terminating number is associated with the data-only device is based on an international mobile equipment identity number.

7. The method of claim 1, further comprising periodically comparing the electronic records associated with the originating number to the entries in the electronic list of grey phone numbers.

8. A system comprising:

a processor; and

a memory device that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising;

comparing electronic call records associated with an originating number of a short messaging service text message to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a data-only device;

determining a match between the electronic call records and a grey phone number in the electronic list of grey phone numbers;

determining that the originating number has previously sent a previous text message to the grey phone number; and

identifying the originating number as a spammer based on the previous text message previously sent to the grey phone number.

9. The system of claim 8, wherein the operations further comprise determining that a terminating number of the short messaging service text message is associated with the data-only device.

10. The system of claim 9, wherein the determining that the terminating number is associated with the data-only device is based on an international mobile equipment identity number.

11. The system of claim 8, wherein the operations further comprise determining a grey ratio associated with the originating number.

12. The system of claim 11, wherein the operations further comprise comparing the grey ratio to a threshold.

13. The system of claim 8, wherein the operations further comprise determining all terminating numbers having an association with the originating number.

14. The system of claim 8, wherein the operations further comprise periodically comparing the electronic call records associated with the originating number to the entries in the electronic list of grey phone numbers.

15. A non-transitory machine-readable storage medium comprising executable instructions which, responsive to being executed by a processor, facilitate performance of operations comprising:

receiving an originating number associated with a short messaging service text message;

retrieving electronic call records associated with the originating number associated with the short messaging service text message;

comparing the electronic call records associated with the originating number to entries in an electronic list of grey phone numbers, each grey phone number in the electronic list of grey phone numbers associated with a device not expected to receive short messaging service text messages;

determining a match between the electronic call records and a grey phone number in the electronic list of grey phone numbers;

determining that the originating number has previously sent a previous text message to the grey phone number; and

identifying the originating number as a spammer based on the previous text message previously sent to the grey phone number.

16. The non-transitory machine-readable storage medium of claim 15, wherein the device not expected to receive the short messaging service text messages is a data-only device.

17. The non-transitory machine-readable storage medium of claim 15, wherein the device not expected to receive the short messaging service text messages is a machine-to-machine communication device.

18. The non-transitory machine-readable storage medium of claim 15, wherein the operations further comprise determining a grey ratio associated with the originating number.

19. The non-transitory machine-readable storage medium of claim 18, wherein the operations further comprise comparing the grey ratio to a threshold.

20. The non-transitory machine-readable storage medium of claim 15, wherein the operations further comprise determining all terminating numbers having an association with the originating number.