TECHNIQUES FOR SCAM DETECTION AND PREVENTION

• US 20190014064A1
• Filed: 07/06/2017
• Published: 01/10/2019
• Est. Priority Date: 07/06/2017
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Strauss, Emanuel Alexandre, Saif Farooqui, Muhammad, Muhammad, Rehman Mehdi, Hwang, Michelle Ruby, Scheffer, Nicolas, Rhyu, Joseph
• Granted Patent: US 10,412,032 B2
• Time in Patent Office: Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/044 Recurrent networks, e.g. Hopfield networks
• CPC Class Codes: G06N 3/045 Combinations of networks
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/52 for supporting social networking services
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Techniques for scam detection and prevention are described. In one embodiment, an apparatus may comprise an interaction processing component operative to generate a scam message example repository; submit the scam message example repository to a natural-language machine learning component; and receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository; an interaction monitoring component operative to monitor a plurality of messaging interactions with a messaging system based on the scam message model; and determine a suspected scam messaging interaction of the plurality of messaging interactions; and a scam action component operative to perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction. Other embodiments are described and claimed.

Claims

1. A computer-implemented method, comprising:

generating a scam message example repository;

submitting the scam message example repository to a natural-language machine learning component;

receiving a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;

monitoring a plurality of messaging interactions with a messaging system based on the scam message model;

determining a suspected scam messaging interaction of the plurality of messaging interactions; and

performing a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

2. The method of claim 1, further comprising:

determining a recognition measure for the suspected scam messaging interaction based on the scam message model; and

selecting the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

3. The method of claim 2, the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

4. The method of claim 1, further comprising:

monitoring a second plurality of messaging interactions with the messaging system;

determining a plurality of suspicious messaging interactions based on a message content reuse measure;

flagging the plurality of suspicious messaging interactions for review;

receiving a plurality of confirmed scam messaging interactions of the plurality of suspicious messaging interactions; and

including the plurality of confirmed scam messaging interactions in the scam message example repository.

5. The method of claim 1, further comprising:

collecting a sample of messaging interactions with the messaging system; and

including the sample of messaging interactions in the scam message example repository as example non-scan messages.

6. The method of claim 5, further comprising:

anonymizing the sample of messaging interactions for inclusion in the scam message example repository.

7. The method of claim 1, further comprising:

augmenting the sample of messaging interactions based on one or more of user scam reporting, administrator scam flagging, and regular-expression scam-flagging rules.

8. An apparatus, comprising:

an interaction processing component operative to generate a scam message example repository;

submit the scam message example repository to a natural-language machine learning component; and

receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;

an interaction monitoring component operative to monitor a plurality of messaging interactions with a messaging system based on the scam message model; and

determine a suspected scam messaging interaction of the plurality of messaging interactions; and

a scam action component operative to perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

9. The apparatus of claim 8, further comprising:

the interaction monitoring component operative to determine a recognition measure for the suspected scam messaging interaction based on the scam message model; and

the scam action component operative to select the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

10. The apparatus of claim 9, the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

11. The apparatus of claim 8, further comprising:

a message reuse monitoring component operative to monitor a second plurality of messaging interactions with the messaging system;

determine a plurality of suspicious messaging interactions based on a message content reuse measure; and

flag the plurality of suspicious messaging interactions for review; and

the interaction processing component operative to receive a plurality of confirmed scam messaging interactions of the plurality of suspicious messaging interactions; and

include the plurality of confirmed scam messaging interactions in the scam message example repository.

12. The apparatus of claim 8, further comprising:

a message sampling component operative to collect a sample of messaging interactions with the messaging system; and

the interaction processing component operative to include the sample of messaging interactions in the scam message example repository as example non-scan messages.

13. The apparatus of claim 12, further comprising:

the message sampling component operative to anonymize the sample of messaging interactions for inclusion in the scam message example repository.

14. The apparatus of claim 8, further comprising:

the interaction processing component operative to augment the sample of messaging interactions based on one or more of user scam reporting, administrator scam flagging, and regular-expression scam-flagging rules

15. At least one computer-readable storage medium comprising instructions that, when executed, cause a system to:

generate a scam message example repository;

submit the scam message example repository to a natural-language machine learning component;

receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;

monitor a plurality of messaging interactions with a messaging system based on the scam message model;

determine a suspected scam messaging interaction of the plurality of messaging interactions; and

perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

16. The computer-readable storage medium of claim 15, comprising further instructions that, when executed, cause a system to:

determine a recognition measure for the suspected scam messaging interaction based on the scam message model; and

select the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

17. The computer-readable storage medium of claim 16, the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

18. The computer-readable storage medium of claim 15, comprising further instructions that, when executed, cause a system to:

monitor a second plurality of messaging interactions with the messaging system;

determine a plurality of suspicious messaging interactions based on a message content reuse measure;

flag the plurality of suspicious messaging interactions for review;

receive a plurality of confirmed scam messaging interactions of the plurality of suspicious messaging interactions; and

include the plurality of confirmed scam messaging interactions in the scam message example repository.

19. The computer-readable storage medium of claim 15, comprising further instructions that, when executed, cause a system to:

collect a sample of messaging interactions with the messaging system;

anonymize the sample of messaging interactions for inclusion in the scam message example repository; and

include the sample of messaging interactions in the scam message example repository as example non-scan messages.

20. The computer-readable storage medium of claim 15, comprising further instructions that, when executed, cause a system to:

augment the sample of messaging interactions based on one or more of user scam reporting, administrator scam flagging, and regular-expression scam-flagging rules.