Cognitive security for voice phishing activity

• US 9,966,078 B2
• Filed: 09/19/2015
• Issued: 05/08/2018
• Est. Priority Date: 10/09/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Allen, Corville O., Byron, Donna K., Freed, Andrew R.
• Primary Examiner(s): Ky, Kevin
• Application Number:
  US14/859,258
• Publication Number:
  US 20160104485A1
• Time in Patent Office: 962 Days
• Field of Search: 704243
• CPC Class Codes: G10L 15/1822 Parsing for meaning understanding
• CPC Class Codes: G10L 17/02 Preprocessing operations, e.g. segment selection; Pattern representation or modelling, e.g. based on linear discriminant analysis [LDA] or principal components; Feature selection or extraction
• CPC Class Codes: G10L 17/08 Use of distortion metrics or a particular distance between probe pattern and reference templates
• CPC Class Codes: G10L 17/26 Recognition of special voice characteristics, e.g. for use in lie detectors; Recognition of animal voices
• CPC Class Codes: G10L 25/51 for comparison or discrimination
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

An approach is provided in which a question answer system monitors a voice conversation between a first entity and a second entity. During the conversation, the question answer system parses the conversation into information phrases, and constructs the information phrases into a current conversation pattern. The question answer system identifies deceptive conversation properties of the current conversation by analyzing the current conversation pattern against domain-based conversation patterns. The question answer system, in turn, sends an alert message to the first entity to notify the first entity of the identified deceptive conversation properties.

Claims

1. A method implemented by an information handling system that includes a memory and a processor, the method comprising:

generating, by the processor, a plurality of information elements based upon a voice conversation between a first entity and a second entity over a communication network;

constructing a current conversation pattern from the plurality of information elements, wherein the current conversation pattern specifies an order of the plurality of information elements based upon the voice conversation;

identifying one or more deceptive conversation properties of the current conversation pattern based upon analyzing the order of the plurality of information elements in the current conversation pattern against one or more domain-based conversation patterns; and

sending an alert message to the first entity based upon the identified one or more deceptive conversation properties.

2. The method of claim 1 wherein the voice conversation comprises one or more conversation statements, the method further comprising:

parsing the one or more conversation statements into a plurality of information phrases based upon cognitive analysis of the one or more conversation statements by a question answer system, wherein the plurality of information elements are generated from the plurality of information phrases;

determining the order of the plurality of information elements based upon a relative order of the plurality of information phrases in the voice conversation; and

storing the plurality of information elements in the determined order into the current conversation pattern.

3. The method of claim 2 further comprising:

generating a suspicion score based upon comparing the order of the plurality of information elements against one or more valid element orders corresponding to at least one of the one or more domain-based conversation patterns; and

generating the alert message in response to determining that the suspicion score reaches a suspicion threshold.

4. The method of claim 1 further comprising:

retrieving sensitive data corresponding to a first entity user of the first entity;

generating a validation question based upon the retrieved sensitive data, wherein the validation question is configured to be asked by the first entity to validate a second entity user of the second entity; and

sending the validation question to the first entity.

5. The method of claim 4 further comprising:

receiving an validation answer from the second entity in response to the first entity user asking the validation question to the second entity user;

determining whether the second entity is a deceptive entity based upon analyzing the received answer against the sensitive data; and

notifying the first entity based upon the determination.

6. The method of claim 1 further comprising:

ingesting a conversation pattern corpora that includes a plurality of documents; and

generating a conversation pattern domain based upon the plurality of documents, wherein the conversation pattern domain comprises a set of valid conversation patterns and a set of deceptive conversation patterns, and wherein the one or more domain-based conversation patterns are included in the conversation pattern domain.

7. The method of claim 1 further comprising:

sending the alert message to a client device selected from the group consisting of a mobile phone, a landline phone, a television, and a computer system.

8. The method of claim 1 further comprising:

detecting that the first entity is attempting to provide sensitive content to the second entity;

prohibiting the sensitive content from being provided to the second entity;

sending a request to the first entity to authorize sending the sensitive content to the second entity; and

terminating the voice conversation in response to not receiving an authorization from the first entity.

9. The method of claim 1 wherein the current conversation pattern corresponds to a dialogue between the first entity and the second entity, and wherein at least one of the plurality of information elements corresponds to the first entity and at least one of the plurality of information elements corresponds to the second entity.