Identifying spam callers in call records
Phone numbers can be identified as being associated with spam callers. Data associated with previously identified spammer phone numbers is analyzed to obtain one or more input parameters for a classification engine. The classification engine uses the input parameters to identify one or more phone numbers in data associated with currently active phone numbers as being associated with spam callers. The one or more phone numbers identified as being associated with spam callers can be provided to call blockers of end-user telephone devices.
1. A method for identifying spam callers, the method comprising:
receiving, by a classifier of an analytical engine from one or more data sources, first data associated with voice calls of previously identified spammer phone numbers;
receiving second data associated with voice calls of phone numbers,
wherein the second data includes phone numbers associated with the voice calls that are different from the previously identified spammer phone numbers;
determining, by the classifier of the analytical engine applying one or more machine learning algorithms to the received first data, values for one or more parameters that each indicate a spam caller behavior
wherein the one or more parameters include at least one member of the group consisting of
a ratio of a number of unique incoming callers for a phone number in the second data to a total number of incoming callers for the same phone number, and
a ratio of a number of outgoing calls from a phone number in the second data having a duration greater than a predetermined or configurable threshold to a total number of outgoing calls from the same phone number;
identifying one or more phone numbers in the second data as associated with the spam caller behavior based on the one or more phone numbers having values for at least one of the one or more parameters determined to indicate spam caller behavior by the classifier of the analytical engine; and
providing the identified one or more phone numbers to a call blocker of a telephone device.
2. The method of claim 1 , wherein the one or more parameters further include a maximum call duration.
3. The method of claim 1 , further comprising:
in response to determining that a phone number in the second data cannot be classified, issuing a request to one or more end-user telephone devices for information regarding the phone number;
in response to receiving one or more replies to the one or more requests, classifying the phone number in accordance with the one or more replies.
4. The method of claim 1 , wherein the call blocker is configured to reject a call in response to determining a phone number associated with the call is included in the one or more phone numbers in the second data as associated with a spam caller.
5. The method of claim 1 , further comprising anonymizing end-user phone numbers in the second data.
6. The method of claim 1 , wherein receiving the second data associated with the phone numbers includes receiving call log data from a plurality of anti-malware components, wherein each anti-malware component comprises one of a plurality of end-user devices.
7. The method of claim 1 , wherein determining, from the first data, one or more parameters for a classification engine includes performing feature selection on the first data, wherein the one or more parameters represent features associated with spam callers.
8. A non-transitory machine-readable medium having instructions stored thereon, that when executed, cause one or more processors to:
receive, by a classifier of an analytical engine from one or more data sources, first data associated with voice calls of previously identified spammer phone numbers;
receive second data associated with voice calls of phone numbers,
wherein the second data includes phone numbers associated with the voice calls that are different from the previously identified spammer phone numbers;
determine, by the classifier of the analytical engine applying one or more machine learning algorithms to the received first data, values for one or more parameters that indicate a spam caller behavior, wherein the one or more parameters include at least one member of the group consisting of,
a ratio of a number of unique incoming callers for a phone number in the second data to a total number of incoming callers for the same phone number, and
a ratio of a number of outgoing calls from a phone number in the second data having a duration greater than a predetermined or configurable threshold to a total number of outgoing calls from the same phone number;
identify one or more phone numbers in the second data as associated with the spam caller behavior based on the one or more phone numbers having values for at least one of the one or more parameters determined to indicate spam caller behavior by the classifier of the analytical engine; and
provide the identified one or more phone numbers to a call blocker of a telephone device.
9. The non-transitory machine-readable medium of claim 8 , wherein the one or more parameters further include a maximum call duration.
10. The non-transitory machine-readable medium of claim 8 , wherein the instructions further comprise instructions to cause the one or more processors to:
in response to a determination by the one or more processors that a phone number in the second data cannot be classified, issue a request to one or more end-user telephone devices for information regarding the phone number;
in response to receipt of one or more replies to the one or more requests, classify the phone number in accordance with the one or more replies.
11. The non-transitory machine-readable medium of claim 8 , wherein the call blocker is configured to reject a call in response to determining a phone number associated with the call is included in the one or more phone numbers in the second data as associated with a spam caller.
12. The non-transitory machine-readable medium of claim 8 , wherein the instructions to receive the second data associated with the phone numbers include instructions to receive call log data from a plurality of anti-malware components, wherein each anti-malware component comprises one of a plurality of end-user mobile devices.
13. The non-transitory machine-readable medium of claim 8 , wherein determining, from the first data, one or more parameters for a classification engine includes performing feature selection on the first data, wherein the one or more parameters represent features associated with spam callers.
14. A system comprising:
one or more processors;
a network interface; and
a non-transitory machine-readable medium having instructions stored thereon, that when executed, cause the one or more processors to:
receive, by a classifier of an analytical engine from one or more data sources via the network interface, first data associated with voice calls of previously identified spammer phone numbers,
receive second data associated with voice calls of phone numbers,
wherein the second data includes phone numbers associated with the voice calls that are different from the previously identified spammer phone numbers,
determine, by the classifier of the analytical engine applying one or more machine learning algorithms to the received first data, values for one or more parameters that each indicate a spam caller behavior,
wherein the one or more parameters include at least one member of the group consisting of,
a ratio of a number of unique incoming callers for a phone number in the second data to a total number of incoming callers for the same phone number, and
a ratio of a number of outgoing calls from a phone number in the second data having a duration greater than a predetermined or configurable threshold to a total number of outgoing calls for the same phone number,
identify one or more phone numbers in the second data as associated with the spam caller behavior based on the one or more phone numbers having values for at least one of the one or more parameters determined to indicate spam caller behavior by the classifier of the analytical engine, and
provide the identified one or more phone numbers to a call blocker of a telephone device.
15. The system of claim 14 , wherein the one or more parameters further include a maximum call duration.
16. The system of claim 14 , wherein the instructions further comprise instructions to cause the one or more processors to:
in response to a determination by the one or more processors that a phone number in the second data cannot be classified, issue a request to one or more end-user telephone devices for information regarding the phone number;
in response to receipt of one or more replies to the one or more requests, classify the phone number in accordance with the one or more replies.
17. The system of claim 14 , wherein the call blocker is configured to reject a call in response to determining a phone number associated with the call is included in the one or more phone numbers in the second data as associated with a spam caller.
18. The system of claim 14 , wherein the instructions to receive the second data associated with the phone numbers include instructions to receive call log data from a plurality of anti-malware components, wherein each anti-malware component comprises one of a plurality of end-user mobile devices.
19. The system of claim 14 , wherein determining, from the first data, one or more parameters for a classification engine includes performing feature selection on the first data, wherein the one or more parameters represent features associated with spam callers.
20. The system of claim 14 , wherein the instructions further comprise instructions to cause the one or more processors to anonymize end-user phone numbers in the second data.