Method and device for spam SMS detection

1. A method to detect spam SMS messages, i.e. unsolicited repeated SMS messages originating from or sent to one or more subscribers of one or more mobile communication networks, said method comprising:

clustering SMS messages in similarity clusters, wherein each similarity cluster comprises SMS messages with identical or similar content; and

monitoring a rate of SMS messages in each similarity cluster,

wherein said method further comprises:

counting an amount of SMS messages in each similarity cluster; and

classifying SMS messages of a similarity cluster as spam when said amount of SMS messages in said similarity cluster exceeds a certain first threshold and said rate of SMS messages for said similarity cluster exceeds a certain second threshold.

2. A method to detect spam SMS messages according to claim 1 , said method comprising:

upon receipt of each SMS message, determining a spam key value by applying locality-sensitive hashing, each spam key value corresponding to a similarity cluster of said similarity clusters;

determining a spam classification value as 0 when said spam key value is no repeated value, or as a value greater than 0 when said spam key value is a repeated value, said value greater than 0 being determined based on a spam score, i.e. said amount of SMS messages in said similarity cluster corresponding to said spam key value, and a spam velocity, i.e. said rate of SMS messages in said similarity cluster having said spam key value; and

storing said spam key value, associated spam score and associated spam classification value for said similarity cluster in memory.

3. A method to detect spam SMS messages according to claim 2 , wherein said locality-sensitive hashing determines a hash value for said SMS message corresponding to said spam key value for said SMS message from:

a top x % bytes distribution of said SMS message, x being a configurable parameter chosen in the range between 30 and 40;

a similarity distance between said top x % bytes distribution and a hypothetical distribution;

a similarity distance value between blocks of text;

the length of said SMS message; and

the calling address of said SMS message.

4. A method to detect spam SMS messages according to claim 3 , wherein said similarity distance between said top x % bytes distribution and a hypothetical distribution corresponds to a cosine similarity distance, and said similarity distance value between blocks of text corresponds to a cosine similarity distance.

5. A method to detect spam SMS messages according to claim 2 , wherein, when said spam key value is no repeated value, determining said spam classification value comprises:

making said spam classification value 0; and

storing said spam key value, associated spam score and associated spam classification value in memory.

6. A method to detect spam SMS messages according to claim 5 , wherein storage of said spam key value, associated spam score and associated spam classification value expires when a first time threshold exceeds and no repeated SMS message with identical spam key value is received.

7. A method to detect spam SMS messages according to claim 2 , wherein, when said spam key value is a repeated value with associated spam classification value equal to 0, determining said spam classification value comprises:

increasing an associated spam score for said spam key value by 1; and

making said spam classification value equal to 1 when said spam score exceeds a first spam threshold within a first time threshold.

8. A method to detect spam SMS messages according to claim 7 , wherein storage of said spam key value, associated spam score and associated spam classification value expires when a second time threshold exceeds and no repeated SMS message with identical spam key value is received or alternatively when said spam velocity drops below a first spam velocity threshold.

9. A method to detect spam SMS messages according to claim 2 , wherein, when said spam key value is a repeated value with associated spam classification value equal to 1, determining said spam classification value comprises:

increasing an associated spam score for said spam key value by 1;

making said spam classification value equal to 2; and

reporting presence of a spam SMS message.

10. A method to detect spam SMS messages according to claim 9 , wherein storage of said spam key value, associated spam score and associated spam classification value expires when a third time threshold exceeds and no repeated SMS message with identical spam key value is received or alternatively when said spam velocity drops below a second spam velocity threshold.

11. A device to detect spam SMS messages, i.e. unsolicited repeated SMS messages originating from or sent to one or more subscribers of one or more mobile communication networks, said device comprising:

an SMS clustering unit adapted to cluster SMS messages in similarity clusters, wherein each similarity cluster comprises SMS messages with identical or similar content; and

a rate monitor adapted to monitor a rate of SMS messages in each similarity cluster;

wherein said device further comprises:

a counter adapted to count an amount of SMS messages in each similarity cluster; and

a spam classifier adapted to classify SMS messages of a similarity cluster as spam when said amount of SMS messages in said similarity cluster exceeds a certain first threshold and said rate of SMS messages for said similarity cluster exceeds a certain second threshold.