DETECTION AND BLOCKING OF MESSAGES BASED ON URL BRAND PHISHING OR SMISHING
Systems and methods for processing messages to determine if the message is potentially fraudulent. The system determines if a word in the message matches a known fraudulent word or a known safe word and labels the message as potentially fraudulent in response the word matching a known fraudulent word. Otherwise, the system determines a probability that the word is potentially fraudulent based on message context. In response to determining that the probability exceeds a first threshold, the system determines distances for each pair of word/known safe words (e.g., known brands). The system labels the message as potentially fraudulent in response to the distance of a pair exceeding a second threshold. If the message is labeled as potentially fraudulent it is discarded, otherwise it is forwarded towards the destination.
1 . A method, comprising:
receiving a message having at least one target word intended for a destination;
for each target word in the message:
determining if the target word matches a known fraudulent word or a known safe word;
in response to determining that the target word matches a known fraudulent word, labeling the message as potentially fraudulent; and
in response to determining that the target word does not match a known fraudulent word or a known safe word:
determining a probability that the target word is potentially fraudulent based on context of the target word in the message;
in response to determining that the probability exceeds a first threshold:
determining grammatical distance values between the target word and each known safe word from a list of known safe words for each target word/known safe word pair; and
in response to the grammatical distance value of a target word/known safe word pair exceeding a second threshold, labeling the message as potentially fraudulent;
in response to labeling the message as potentially fraudulent, discarding the message; and
in response to not labeling the message as potentially fraudulent, forwarding the message towards the destination.
2 . The method of claim 1 , further comprising:
in response to determining that the target word matches a known safe word, labeling the target word as non-fraudulent.
3 . The method of claim 1 , further comprising:
labeling the target word as non-fraudulent in response to determining that the target word matches a known safe word; and
processing a next target word in the message in response to labeling the target word as non-fraudulent.
4 . The method of claim 1 , further comprising:
in response to the grammatical distance value of a target word/known safe word pair not exceeding a third threshold, labeling the target word as non-fraudulent.
5 . The method of claim 1 , further comprising:
labeling the target word as safe in response to the grammatical distance value of a target word/known safe word pair not exceeding a third threshold; and
processing a next target word in the message in response to labeling the target word as non-fraudulent.
6 . The method of claim 1 , further comprising:
in response to the grammatical distance value of a target word/known safe word pair not exceeding the second threshold but exceeding a third threshold, performing additional fraudulent metrics on the target word.
7 . The method of claim 1 , further comprising:
determining an aggregated number of previous events associated with the target word in other messages;
generating a combined value for each target word/known safe word pair by combining the grammatical distance values with the aggregated number of previous events for each target word/known safe word pair; and
in response to the combined value for a target word/known safe word pair exceeding the second threshold, labeling the message as potentially fraudulent.
8 . The method of claim 7 , further comprising:
in response to the combined value for a target word/known safe word pair not exceeding the second threshold but exceeding a third threshold, performing additional fraudulent metrics on the target word.
9 . A computing device, comprising:
a memory that stores computer instructions; and
a processor configured to execute the computer instructions to:
receive a message having at least one target word intended for a destination;
for each target word in the message:
determine if the target word matches a known fraudulent word or a known safe word;
label the message as potentially fraudulent in response to determining that the target word matches a known fraudulent word; and
in response to determining that the target word does not match a known fraudulent word or a known safe word:
determine a probability that the target word is potentially fraudulent based on context of the target word in the message; and
in response to determining that the probability exceeds the first threshold:
determine grammatical distance values between the target word and each known safe word from a list of known safe words for each target word/known safe word pair; and
label the message as potentially fraudulent in response to the grammatical distance value of a target word/known safe word pair exceeding a second threshold;
discard the message in response to labeling the message as potentially fraudulent; and
forward the message towards the destination in response to not labeling the message as potentially fraudulent.
10 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
in response to determining that the target word matches a known safe word, label the target word as non-fraudulent.
11 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
label the target word as non-fraudulent in response to determining that the target word matches a known safe word; and
process a next target word in the message in response to labeling the target word as non-fraudulent.
12 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
in response to the grammatical distance value of a target word/known safe word pair not exceeding a third threshold, label the target word as non-fraudulent.
13 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
label the target word as safe in response to the grammatical distance value of a target word/known safe word pair not exceeding a third threshold.
process a next target word in the message in response to labeling the target word as non-fraudulent.
14 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
in response to the grammatical distance value of a target word/known safe word pair not exceeding the second threshold but exceeding a third threshold, perform additional fraudulent metrics on the target word.
15 . The computing device of claim 9 , wherein the processor is configured to further execute the computer instructions to:
determine an aggregated number of previous events associated with the target word in other messages;
generate a combined value for each target word/known safe word pair by combining the grammatical distance values with the aggregated number of previous events for each target word/known safe word pair; and
in response to the combined value for a target word/known safe word pair exceeding the second threshold, label the message as potentially fraudulent.
16 . The computing device of claim 15 , wherein the processor is configured to further execute the computer instructions to:
in response to the combined value for a target word/known safe word pair not exceeding the second threshold but exceeding a third threshold, perform additional fraudulent metrics on the target word.
17 . A system, comprising:
pre-check circuitry configured to:
receive a message having a target word intended for a destination;
determine if the target word matches a known fraudulent word or a known safe word; and
label the message as potentially fraudulent in response to determining that the target word matches a known fraudulent word;
candidate creation circuitry configured to:
determine a probability that the target word is potentially fraudulent based on context of the target word in the message in response to determining that the target word does not match a known fraudulent word or a known safe word; and
distance calculation circuitry configured to:
determine grammatical distance values between the target word and each known safe word from a list of known safe words for each target word/known safe word pair in response to determining that the probability does exceeds the first threshold; and
spam decision circuitry configured to:
label the message as potentially fraudulent in response to the grammatical distance value of a target word/known safe word pair exceeding a second threshold;
discard the message in response to labeling the message as potentially fraudulent; and
forward the message towards the destination in response to not labeling the message as potentially fraudulent.
18 . The system of claim 17 , wherein the pre-check circuitry is further configured to:
label the target word as non-fraudulent in response to determining that the target word matches a known safe word; and
process a next target word in the message in response to labeling the target word as non-fraudulent.
19 . The system of claim 17 , wherein the distance calculation circuitry is further configured to:
label the target word as safe in response to the grammatical distance value of a target word/known safe word pair not exceeding a third threshold; and
process a next target word in the message in response to labeling the target word as non-fraudulent.
20 . The system of claim 17 , wherein the spam decision circuitry is further configured to:
determine an aggregated number of previous events associated with the target word in other messages;
generate a combined value for each target word/known safe word pair by combining the grammatical distance values with the aggregated number of previous events for each target word/known safe word pair;
label the message as potentially fraudulent in response to the combined value for a target word/known safe word pair exceeding the second threshold; and
perform additional fraudulent metrics on the target word in response to the combined value for a target word/known safe word pair not exceeding the second threshold but exceeding a third threshold.