IP Library Granted Patent US 12,199,933
Granted Patent B2
US 12,199,933 · App. 18/596,032 · Granted Jan 14, 2025

Bulk messaging detection and enforcement

Inventors: Thomas Lee (Kensington, CA); Sarah Solieman (Los Angeles, CA)
Assignee: Proofpoint, Inc.
H04L51/212G06F16/955H04L51/58H04L63/0245H04L63/1441H04L63/1483H04W4/14
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,199,933
App. No.
18/596,032
Granted
Jan 14, 2025
Kind
B2
Abstract

Aspects of the disclosure relate to providing commercial and/or spam messaging detection and enforcement. A computing platform may receive a plurality of text messages from a sender. It may then tokenize the plurality of text messages to yield a plurality of tokens. The computing platform may then match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens. Next, it may detect one or more homoglyphs in the plurality of text messages, and then detect one or more URLs in the plurality of text messages. The computing platform may flag the sender based at least on the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs. Based on flagging the sender, the computing platform may block one or more messages from the sender.

Claims (78)

1. A method comprising:

at a message scanning computing platform comprising one or more processors, a communication interface, and memory storing computer-readable instructions:

receiving, via the communication interface, by the one or more processors, a plurality of text messages from a sender;

determining a type of channel for each received message of the plurality of text messages, wherein the type of channel is selected from an application to person (A2P) channel and a person to person (P2P) channel;

tokenizing, by the one or more processors, the plurality of text messages to yield a plurality of tokens;

matching, by the one or more processors, one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detecting, by the one or more processors, one or more homoglyphs in the plurality of text messages;

detecting, by the one or more processors, one or more uniform resource locators (URLs) in the plurality of text messages;

flagging, by the one or more processors, the sender as one of: a spam sender or a commercial sender based at least on the type of channel, the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender as a spam sender, executing one or more enforcement policies associated with the sender.

2. The method of claim 1 , wherein the one or more enforcement policies are customized for a particular user.

3. The method of claim 1 , wherein flagging the sender as a spam sender further includes:

generating the one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the one or more enforcement policies.

4. The method of claim 1 , further comprising:

retrieving, by the one or more processors, a training data set, wherein the training data set includes input data comprising data indicating one or more bulk string tokens in text messages, data indicating homoglyphs in text messages, and data indicating URLs in text messages, wherein the training data set further includes target data comprising an indication of a flag to be applied to the text messages; and

training, by the one or more processors, a model using the training data set.

5. The method of claim 4 , wherein the flagging of the sender as a spam sender comprises:

using the type of channel, the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs to generate inputs to the model; and

providing the inputs to the model to generate an output, wherein the output indicates that the sender should be flagged as a spam sender.

6. The method of claim 5 , wherein the inputs to the model include frequency information for the type of channel, the one or more matching tokens, the one or more detected homoglyphs, or the one or more detected URLs.

7. The method of claim 1 , further comprising categorizing, by the one or more processors, one or more of the matched tokens into a category associated with a bulk string token of the one or more bulk string tokens, wherein the category is selected from a list of categories, wherein the list of categories includes one or more of:

an advertisement,

spam, or

a political message.

8. The method of claim 1 , further comprising:

prior to flagging the sender as a spam sender, comparing, by the one or more processors, a number of the plurality of text messages received to a threshold; and

based on the number not satisfying the threshold, waiting, by the one or more processors, to receive additional messages before flagging the sender as a spam sender.

9. The method of claim 1 , wherein the detecting the one or more homoglyphs comprises:

analyzing a message to detect a most common script of character used in the message; and

detecting a homoglyph based on detecting a character of the message that is a different script from the most common script.

10. The method of claim 1 , wherein the detecting the one or more homoglyphs comprises:

substituting at least one character of a word for a homoglyph;

comparing the word with the substituted at least one character to a dictionary; and

detecting that at least one character of the word is a homoglyph based on the comparing.

11. The method of claim 1 , further comprising categorizing, by the one or more processors, the detected URLs as one or more of:

unknown URLs,

URLs associated with spam, or

URLs associated with commercial domains.

12. A computing platform comprising:

one or more processors;

a communication interface, and

memory storing computer-readable instructions that, when executed by the one or more processors, cause the computing platform to:

receive, via the communication interface, a plurality of text messages from a sender;

determine a type of channel for each received message of the plurality of text messages, wherein the type of channel is selected from an application to person (A2P) channel and a person to person (P2P) channel;

tokenize the plurality of text messages to yield a plurality of tokens;

match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detect one or more homoglyphs in the plurality of text messages;

detect one or more uniform resource locators (URLs) in the plurality of text messages;

flag the sender as one of: a spam sender or a commercial sender based at least on the type of channel, the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender as a spam sender, executing one or more enforcement policies associated with the sender.

13. The computing platform of claim 12 , wherein the one or more enforcement policies are customized for a particular user.

14. The computing platform of claim 12 , wherein flagging the sender as a spam sender further includes:

generating the one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the one or more enforcement policies.

15. The computing platform of claim 12 , wherein the flagging of the sender as a spam sender further comprises:

using the type of channel, the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs to generate inputs to a machine learning model; and

providing the inputs to the machine learning model to generate an output, wherein the output indicates that the sender should be flagged as a spam sender.

16. The computing platform of claim 15 , wherein the inputs to the machine learning model include frequency information for the type of channel, the one or more matching tokens, the one or more detected homoglyphs, or the one or more detected URLs.

17. The computing platform of claim 12 , wherein the detecting the one or more homoglyphs comprises:

analyzing a message to detect a most common script of character used in the message; and

detecting a homoglyph based on detecting a character of the message that is a different script from the most common script.

18. One or more non-transitory computer-readable media comprising instructions that, when executed by a computing platform comprising one or more processors and a communication interface, cause the computing platform to:

receive, via the communication interface, a plurality of text messages from a sender;

determine a type of channel for each received message of the plurality of text messages, wherein the type of channel is selected from an application to person (A2P) channel and a person to person (P2P) channel;

tokenize the plurality of text messages to yield a plurality of tokens;

match one or more tokens of the plurality of tokens in the plurality of text messages to one or more bulk string tokens;

detect one or more homoglyphs in the plurality of text messages;

detect one or more uniform resource locators (URLs) in the plurality of text messages;

flag the sender as one of: a spam sender or a commercial sender based at least on the type of channel, the one or more matching tokens, the one or more detected homoglyphs, and the one or more detected URLs; and

based on flagging the sender as a spam sender, executing one or more enforcement policies associated with the sender.

19. The one or more non-transitory computer-readable media of claim 18 , wherein the one or more enforcement policies are customized for a particular user.

20. The one or more non-transitory computer-readable media of claim 18 , wherein flagging the sender as a spam sender further includes:

generating the one or more enforcement policies associated with the sender;

associating the one or more enforcement policies with an identifier of the sender; and

storing the one or more enforcement policies.

Assignments (3)
INTELLECTUAL PROPERTY AGREEMENT SUPPLEMENT Recorded Dec 9, 2025
From: PROOFPOINT, INC.
To: GOLDMAN SACHS BANK USA, AS COLLATERAL AGENT
Reel/Frame 073910/0027 →
SECOND LIEN INTELLECTUAL PROPERTY SECURITY AGREEMENT Recorded Dec 8, 2025
From: PROOFPOINT, INC.
To: U.S. BANK TRUST COMPANY, NATIONAL ASSOCIATION, AS COLLATERAL AGENT
Reel/Frame 073889/0677 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 6, 2024
From: LEE, THOMAS; SOLIEMAN, SARAH
To: PROOFPOINT, INC.
Reel/Frame 066663/0025 →