Bulk messaging detection and enforcement

1. A method comprising:

at a message scanning computing platform comprising one or more processors, a communication interface, and memory storing computer-readable instructions:

receiving, via the communication interface, by the one or more processors, a plurality of text messages from a sender, wherein the plurality of text messages is received from a plurality of different telephone numbers;

using, by the one or more processors, a clustering algorithm to associate the plurality of different telephones numbers with the sender;

tokenizing, by the one or more processors, the plurality of text messages to yield a plurality of tokens;

matching, by the one or more processors, one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detecting, by the one or more processors, one or more homoglyphs in the plurality of text messages;

detecting, by the one or more processors, one or more uniform resource locators (URLs) in the plurality of text messages;

flagging, by the one or more processors, the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender, blocking, by the one or more processors, one or more messages from the sender, wherein blocking the one or more messages from the sender includes blocking text messages received from the plurality of different telephone numbers.

2. The method of claim 1 , wherein the plurality of text messages is received via a peer-to-peer (P2P) channel.

3. The method of claim 1 , wherein the sender is flagged as a spam sender and wherein flagging the sender further includes:

generating one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the enforcement policy.

4. The method of claim 1 , further comprising:

retrieving, by the one or more processors, a training data set, wherein the training data set includes input data comprising data indicating one or more bulk string tokens in text messages, data indicating homoglyphs in text messages, and data indicating URLs in text messages, wherein the training data set further includes target data comprising an indication of a flag to be applied to the text messages; and

training, by the one or more processors, a model using the training data set.

5. The method of claim 4 , wherein the flagging of the sender comprises:

using the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs to generate inputs to the model; and

providing the inputs to the model to generate an output, wherein the output indicates that the sender should be flagged.

6. The method of claim 5 , wherein the inputs to the model include frequency information for the one or more matching tokens, the one or more detected homoglyphs, or the one or more detected URLs.

7. The method of claim 1 , further comprising categorizing, by the one or more processors, one or more of the matched tokens into a category associated with the bulk string token, wherein the category is selected from a list of categories, wherein the list of categories includes one or more of:

an advertisement,

spam, or

a political message.

8. The method of claim 1 , further comprising:

prior to flagging the sender, comparing, by the one or more processors, a number of the plurality of text messages received to a threshold; and

based on the number not satisfying the threshold, waiting, by the one or more processors, to receive additional messages before flagging the sender.

9. The method of claim 1 , wherein the detecting the one or more homoglyphs comprises:

analyzing a message to detect a most common script of character used in the message; and

detecting a homoglyph based on detecting a character of the message that is a different script from the most common script.

10. The method of claim 1 , wherein the detecting the one or more homoglyphs comprises:

substituting at least one character of a word for a homoglyph;

comparing the word with the substituted at least one character to a dictionary; and

detecting that at least one character of the word is a homoglyph based on the comparing.

11. The method of claim 1 , further comprising categorizing, by the one or more processors, the detected URLs as one or more of:

unknown URLs,

URLs associated with spam, or

URLs associated with commercial domains.

12. A computing platform comprising:

one or more processors;

a communication interface, and

memory storing computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

receive, via the communication interface, a plurality of text messages from a sender, wherein the plurality of text messages is received from a plurality of different telephone numbers;

use a clustering algorithm to associate the plurality of different telephones numbers with the sender;

tokenize the plurality of text messages to yield a plurality of tokens;

match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detect one or more homoglyphs in the plurality of text messages;

detect one or more uniform resource locators (URLs) in the plurality of text messages;

flag the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender, block one or more messages from the sender, wherein blocking the one or more messages from the sender includes blocking text messages received from the plurality of different telephone numbers.

13. The computing platform of claim 12 , wherein the plurality of text messages is received via a peer-to-peer (P2P) channel.

14. The computing platform of claim 12 , wherein the sender is flagged as a spam sender and wherein flagging the sender further includes:

generating one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the enforcement policy.

15. The computing platform of claim 12 , wherein the flagging of the sender further comprises:

using the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs to generate inputs to a machine learning model; and

providing the inputs to the machine learning model to generate an output, wherein the output indicates that the sender should be flagged.

16. One or more non-transitory computer-readable media comprising instructions that, when executed by a computing platform comprising one or more processors and a communication interface, cause the computing platform to:

receive, via the communication interface, a plurality of text messages from a sender, wherein the plurality of text messages is received from a plurality of different telephone numbers;

use, by the one or more processors, a clustering algorithm to associate the plurality of numbers;

tokenize the plurality of text messages to yield a plurality of tokens;

match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detect one or more homoglyphs in the plurality of text messages;

detect one or more uniform resource locators (URLs) in the plurality of text messages;

flag the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender, block one or more messages from the sender, wherein blocking the one or more messages from the sender includes blocking text messages received from the plurality of different telephone numbers.

17. The one or more non-transitory computer-readable media of claim 16 , wherein the plurality of text messages is received via a peer-to-peer (P2P) channel.

18. The one or more non-transitory computer-readable media of claim 16 , wherein the sender is flagged as a spam sender and wherein flagging the sender further includes:

generating one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the enforcement policy.