Systems and methods for artificial traffic detection

1 . A method for analyzing traffic data, the method comprising:

receiving message events;

aggregating the message events to generate aggregated message events;

receiving a destination address;

performing traffic analysis for the destination address based on the aggregated message events, wherein the traffic analysis comprises determining, using an overall machine learning model, a respective analyzer score for each of the aggregated message events associated with the destination address, wherein the overall machine learning model is configured to output the respective analyzer score for each of the aggregated message events based on outputs of a plurality of criteria machine learning models;

calculating a risk score based on the respective analyzer score for each of the aggregated message events associated with the destination address;

performing a risk action for the destination address based on the risk score;

receiving updated analyzer scores for one or more of the aggregated message events;

calculating an updated risk score based on the updated analyzer scores, wherein calculating the updated risk score is triggered in response to receiving the updated analyzer scores for one or more of the aggregated message events; and

providing the updated risk score via an application programming interface.

2 . The method of claim 1 , wherein the message events are received from a streaming system, and wherein the destination address represents a phone number.

3 . The method of claim 1 , wherein aggregating the message events comprises indexing the message events and storing the indexed message events at a database.

4 . The method of claim 1 , wherein aggregating the message events comprises associating at least a subset of the message events with a respective brand.

5 . The method of claim 1 , wherein performing the risk action comprises transmitting the risk score to a client.

6 . The method of claim 1 , wherein performing the risk action comprises automatically blocking a destination address based on the risk score exceeding a risk score threshold.

7 . The method of claim 1 , wherein performing the risk action comprises flagging a destination address for more frequent risk score calculation than a current frequency.

8 . A system comprising:

a data storage device storing processor-readable instructions; and

a processor operatively connected to the data storage device and configured to execute the instructions to perform operations that include:

receiving message events;

aggregating the message events to generate aggregated message events;

receiving a destination address;

performing traffic analysis for the destination address based on the aggregated message events, wherein the traffic analysis comprises determining, using an overall machine learning model, a respective analyzer score for each of the aggregated message events associated with the destination address, wherein the overall machine learning model is configured to output the respective analyzer score for each of the aggregated message events based on outputs of a plurality of criteria machine learning models;

calculating a risk score based on the respective analyzer score for each of the aggregated message events associated with the destination address;

performing a risk action for the destination address based on the risk score;

receiving updated analyzer scores for one or more of the aggregated message events;

calculating an updated risk score based on the updated analyzer scores, wherein calculating the updated risk score is triggered in response to receiving the updated analyzer scores for one or more of the aggregated message events; and

providing the updated risk score via an application programming interface.

9 . The system of claim 8 , wherein the message events are received from a streaming system, and wherein the destination address represents a phone number.

10 . The system of claim 8 , wherein aggregating the message events comprises indexing the message events and storing the indexed message events at a database.

11 . The system of claim 8 , wherein aggregating the message events comprises associating at least a subset of the message events with a respective brand.

12 . The system of claim 8 , wherein performing the risk action comprises transmitting the risk score to a client.

13 . The system of claim 8 , wherein performing the risk action comprises automatically blocking a destination address based on the risk score exceeding a risk score threshold.

14 . A method for managing traffic data, the method comprising:

receiving a request for a risk score for a destination address;

identifying aggregated message events stored in a database and associated with the destination address;

receiving a respective analyzer score for each of the aggregated message events, each respective analyzer score output by an overall machine learning model, the overall machine learning model outputting the analyzer scores based on outputs of a plurality of criteria machine learning models;

calculating a risk score for the destination address based on the respective analyzer score for each of the aggregated message events;

providing the risk score via an application programing interface (API);

receiving updated analyzer scores for one or more of the aggregated message events;

calculating an updated risk score based on the updated analyzer scores, wherein calculating the updated risk score is triggered in response to receiving the updated analyzer scores for one or more of the aggregated message events; and

providing the updated risk score via the API.

15 . The method of claim 14 , wherein the plurality of criteria machine learning models are configured to generate a criteria machine learning output based on one or more of a traffic burst, a prefix range, a conversion information, a delivery rate, a message destination time clustering, a destination number of messages, a message frequency, a suspicious range, a destination type, a destination locale, a network anomaly, a brand interaction, a ported destination, an initiated message, or a client classification.

16 . The method of claim 14 , wherein one of the overall machine learning model or the plurality of criteria machine learning models is trained based on historical or simulated data.

17 . The method of claim 14 , wherein the request for a risk score is received via the API.

18 . The method of claim 14 , wherein the destination address represents a telephone number.

19 . A method for managing traffic data, the method comprising:

receiving a request for a risk score for a destination address;

identifying message events stored in a database and associated with the destination address;

receiving analyzer scores for each of the message events, each analyzer score of the analyzer scores output by an overall machine learning model, the overall machine learning model outputting the analyzer scores based on outputs of a plurality of criteria machine learning models;

calculating a risk score for the destination address based on the analyzer scores for each of the message events;

providing the risk score via an application programming interface (API);

receiving updated analyzer scores for one or more of the message events;

calculating an updated risk score based on the updated analyzer scores, wherein calculating the updated risk score is triggered in response to receiving the updated analyzer scores for one or more of the message events; and

providing the updated risk score via the API.

20 . The method of claim 19 , wherein the request for a risk score is received via the API.

21 . A method for managing traffic data, the method comprising:

receiving a request for a risk score for a destination address;

identifying message events stored in a database and associated with the destination address;

receiving analyzer scores for each of the message events, each analyzer score of the analyzer scores output by an overall machine learning model, the overall machine learning model outputting the analyzer scores based on outputs of a plurality of criteria machine learning models;

calculating a risk score for the destination address based on the analyzer scores for each of the message events;

providing the risk score via an application programming interface (API);

receiving updated analyzer scores for one or more of the message events;

calculating an updated risk score based on the updated analyzer scores, wherein the calculating the updated risk score is triggered in response to an expiration of predetermined time; and

providing the updated risk score via the API.

22 . The method of claim 21 , wherein the request for a risk score is received via the API.