Systems and methods for automatically conducting risk assessments for telephony communications
Systems and methods for using machine-learning techniques for labeling incoming calls with categories relating to a risk level. A model is generated using call log data. The call log data is augmented using information from additional data sources to generate features for the model. The model may then be used to categorize additional incoming calls. The model may be used in real-time to categorize incoming calls, or categorization results may be stored for a plurality of calling numbers. Various embodiments provide various technical advantages by virtue of how the components of the system are deployed between an endpoint communication device, a telephony provider system, and possibly other systems.
1. A method for automatically conducting risk assessments for calls to an endpoint communication device, the method comprising:
receiving, by a risk processing engine, a message associated with an incoming call;
extracting, by the risk processing engine, identifying data from the message;
retrieving, by the risk processing engine, information about past calls associated with the identifying data;
determining, by the risk processing engine, a likelihood that an origin of the incoming call is spoofed, wherein the determining includes comparing the information about past calls to the message; and
in response to determining that the likelihood that the origin of the incoming call is spoofed is greater than a predetermined threshold, causing a warning to be presented to a user of the endpoint communication device.
2. The method of claim 1 , wherein the identifying data includes a caller number.
3. The method of claim 1 , wherein the information about past calls associated with the identifying data includes an identification of a service provider.
4. The method of claim 3 , wherein comparing the information about past calls to the message includes:
determining a service provider associated with the incoming call; and
comparing the service provider associated with the incoming call to the service provider identified in the information about past calls.
5. The method of claim 1 , wherein the determining further includes determining a line type associated with the incoming call.
6. The method of claim 1 , wherein at least one of the message associated with the incoming call and the retrieval of the information about past calls is transmitted via session initiation protocol (SIP).
7. The method of claim 1 , wherein at least a portion of the risk processing engine is provided by the endpoint communication device.
8. An endpoint communication device comprising:
a processor; and
a memory storing instructions that, in response to execution by the processor, cause the device to perform actions comprising:
receiving a message associated with an incoming call;
extracting identifying data from the message;
retrieving information about past calls associated with the identifying data;
determining a likelihood that an origin of the incoming call is spoofed, wherein the determining includes comparing the information about past calls to the message; and
in response to determining that the likelihood that the origin of the incoming call is spoofed is greater than a predetermined threshold, presenting a warning to a user of the endpoint communication device.
9. The endpoint communication device of claim 8 , wherein the identifying data includes a caller number.
10. The endpoint communication device of claim 8 , wherein the information about past calls associated with the identifying data includes an identification of a service provider.
11. The endpoint communication device of claim 10 , wherein comparing the information about past calls to the message includes:
determine a service provider associated with the incoming call; and
compare the service provider associated with the incoming call to the service provider identified in the information about past calls.
12. The endpoint communication device of claim 8 , wherein the determining further includes determining a line type associated with the incoming call.
13. The endpoint communication device of claim 8 , wherein at least one of the message associated with the incoming call and the retrieval of the information about past calls is transmitted via session initiation protocol (SIP).
14. A non-transitory computer-readable medium having computer-executable instructions stored thereon that, in response to execution by one or more processors of a computing device, cause the computing device to perform actions for automatically conducting risk assessments for calls to an endpoint communication device, the actions comprising:
receiving a message associated with an incoming call;
extracting identifying data from the message;
retrieving information about past calls associated with the identifying data;
determining a likelihood that an origin of the incoming call is spoofed, wherein the determining includes comparing the information about past calls to the message; and
in response to determining that the likelihood that the origin of the incoming call is spoofed is greater than a predetermined threshold, causing a warning to be presented to a user of the endpoint communication device.
15. The non-transitory computer-readable medium of claim 14 , wherein the identifying data includes a caller number.
16. The non-transitory computer-readable medium of claim 14 , wherein the information about past calls associated with the identifying data includes an identification of a service provider.
17. The non-transitory computer-readable medium of claim 16 , wherein comparing the information about past calls to the message includes:
determining a service provider associated with the incoming call; and
comparing the service provider associated with the incoming call to the service provider identified in the information about past calls.
18. The non-transitory computer-readable medium of claim 14 , wherein the determining further includes determining a line type associated with the incoming call.
19. The non-transitory computer-readable medium of claim 14 , wherein at least one of the message associated with the incoming call and the retrieval of the information about past calls is transmitted via session initiation protocol (SIP).
20. The non-transitory computer-readable medium of claim 14 , wherein the computing device is the endpoint communication device.