System and method for crowd-sourcing mobile messaging spam detection and defense

• US 9,584,989 B2
• Filed: 11/25/2013
• Issued: 02/28/2017
• Est. Priority Date: 11/25/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Skudlark, Ann E., Erman, Jeffrey, Jin, Yu, Srivastava, Abhinav, Tran, Lien K.
• Primary Examiner(s): Khan, Suhail
• Application Number:
  US14/089,167
• Publication Number:
  US 20150148006A1
• Time in Patent Office: 1,191 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

A crowd-sourced mobile messaging spam detection and defense system includes an application running on a mobile device. The application uses an unwanted message detection algorithm to analyze and classify messages as potential unwanted messages. The potential unwanted messages are presented to a user for confirmation that the messages are unwanted messages. In response to confirmation, the mobile device transmits a notification to a virtual machine associated with the user. The virtual machine uses the notification to update the unwanted message detection algorithm which may then be transmitted to the mobile device. The virtual machine may also transmit the notification to a global virtual machine. The global virtual machine may use the notification to update a set of classification rules maintained by the global virtual machine and transmit the set of classification rules as necessary to the multiple virtual machines for use in updating the unwanted message detection algorithm.

Claims

1. A method comprising:

receiving, at a virtual machine associated with a particular user, a notification from a mobile device associated with the particular user identifying that a message received at the mobile device is determined to be an unwanted message based on;

identification of the message as a potential unwanted message by an unwanted message detection algorithm; and

the message being confirmed by the particular user to be the unwanted message in response to presenting the particular user with the message, the message presented with a date and time the message was sent highlighted to indicate that the date and time were considered in identifying the message as the potential unwanted message;

transmitting information pertaining to the notification to a global virtual machine;

receiving an updated set of global classification rules from the global virtual machine, the updated set of global classification rules based on information pertaining to the notification, information pertaining to notifications from a plurality of other user devices associated with the global virtual machine, a number of users that identified a particular message as unwanted, and information pertaining to training messages;

updating, at the virtual machine, a copy of the unwanted message detection algorithm associated with the particular user, based on the notification, the updated set of global classification rules, and a set of personalized classification rules, the updating to generate an updated copy of the unwanted message detection algorithm; and

transmitting the updated copy of the unwanted message detection algorithm to the mobile device associated with the particular user.

2. The method of claim 1, wherein the notification is generated by an application on the mobile device associated with the particular user, the application analyzing messages received by the mobile device using the unwanted message detection algorithm.

3. The method of claim 1 wherein the set of personalized classification rules comprises a rule pertaining to contacts associated with the particular user.

4. The method of claim 1, wherein the virtual machine is one of a plurality of virtual machines, each of the plurality of virtual machines associated with a respective user.

5. The method of claim 1, wherein the updated copy of the unwanted message detection algorithm identifies the particular message as not being a potentially unwanted message in response to the particular message being identified by the set of personalized classification rules as not being a potentially unwanted message and the particular message being identified by the updated set of global classification rules as being a potentially unwanted message.

6. An apparatus comprising:

a processor; and

a memory to store computer program instructions, the computer program instructions when executed on the processor cause the processor to perform operations comprising;

receiving a notification from a mobile device associated with a particular user identifying that a message received at the mobile device is determined to be an unwanted message based on;

identification of the message as an unwanted message by an unwanted message detection algorithm; and

the message being confirmed by the particular user to be the unwanted message in response to presenting the particular user with the message, the message presented with a date and time the message was sent highlighted to indicate that the date and time were considered in identifying the message as the potential unwanted message;

transmitting information pertaining to the notification to a global virtual machine;

receiving an updated set of global classification rules from the global virtual machine, the updated set of global classification rules based on information pertaining to the notification, information pertaining to notifications from a plurality of other user devices associated with the global virtual machine, a number of users that identified a particular message as unwanted, and information pertaining to training messages;

updating a copy of the unwanted message detection algorithm associated with the particular user, based on the notification, the updated set of global classification rules, and a set of personalized classification rules, the updating to generate an updated copy of the unwanted message detection algorithm; and

transmitting the updated copy of the unwanted message detection algorithm to the mobile device associated with the particular user.

7. The apparatus of claim 6, wherein the notification is generated by an application on the mobile device associated with the particular user, the application analyzing messages received by the mobile device using the unwanted message detection algorithm.

8. The apparatus of claim 6 wherein the set of personalized classification rules comprises a rule pertaining to contacts associated with the particular user.

9. The apparatus of claim 6, wherein the updated copy of the unwanted message detection algorithm identifies the particular message as not being a potentially unwanted message in response to the particular message being identified by the set of personalized classification rules as not being a potentially unwanted message and the particular message being identified by the updated set of global classification rules as being a potentially unwanted message.

10. A non-transitory computer readable medium storing computer program instructions, which, when executed on a processor, cause the processor to perform operations comprising:

receiving, at a virtual machine associated with a particular user, a notification from a mobile device associated with the particular user identifying that a message received at the mobile device is determined to be an unwanted message based on;

identification of the message as a potential unwanted message by an unwanted message detection algorithm; and

the message being confirmed by the particular user to be the unwanted message in response to presenting the particular user with the message, the message presented with a date and time the message was sent highlighted to indicate that the date and time were considered in identifying the message as the potential unwanted message;

transmitting information pertaining to the notification to a global virtual machine;

receiving an updated set of global classification rules from the global virtual machine, the updated set of global classification rules based on information pertaining to the notification, information pertaining to notifications from a plurality of other user devices associated with the global virtual machine, a number of users that identified a particular message as unwanted, and information pertaining to training messages;

updating, at the virtual machine, a copy of the unwanted message detection algorithm associated with the particular user, based on the notification, the updated set of global classification rules, and a set of personalized classification rules, the updating to generate an updated copy of the unwanted message detection algorithm; and

transmitting the updated copy of the unwanted message detection algorithm to the mobile device associated with the particular user.

11. The non-transitory computer readable medium of claim 10, wherein the notification is generated by an application on the mobile device associated with the particular user, the application analyzing messages received by the mobile device using the unwanted message detection algorithm.

12. The non-transitory computer readable medium of claim 10, wherein the virtual machine is one of a plurality of virtual machines, each of the plurality of virtual machines associated with a respective user.

13. The non-transitory computer readable medium of claim 10, wherein the updated copy of the unwanted message detection algorithm identifies the particular message as not being a potentially unwanted message in response to the particular message being identified by the set of personalized classification rules as not being a potentially unwanted message and the particular message being identified by the updated set of global classification rules as being a potentially unwanted message.