Techniques for scam detection and prevention

Patent metadata

Field	Value
Publication number	US-10412032-B2
Application number	US-201715642579-A
Country	US
Kind code	B2
Filing date	Jul 6, 2017
Priority date	Jul 6, 2017
Publication date	Sep 10, 2019
Grant date	Sep 10, 2019

Abstract

Techniques for scam detection and prevention are described. In one embodiment, an apparatus may comprise an interaction processing component operative to generate a scam message example repository; submit the scam message example repository to a natural-language machine learning component; and receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository; an interaction monitoring component operative to monitor a plurality of messaging interactions with a messaging system based on the scam message model; and determine a suspected scam messaging interaction of the plurality of messaging interactions; and a scam action component operative to perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction. Other embodiments are described and claimed.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
generating a scam message example repository;
submitting the scam message example repository to a natural-language machine learning component, the natural-language machine learning component to generate a scam message model from the example repository using a message content reuse measure, the content reuse measure to compare a user's reuse of a phrase to the reuse of the phrase in a random message sample;
receiving a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;
monitoring a plurality of messaging interactions with a messaging system based on the scam message model;
determining a suspected scam messaging interaction of the plurality of messaging interactions; and
performing a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

2. The method of claim 1 , further comprising:
determining a recognition measure for the suspected scam messaging interaction based on the scam message model; and
selecting the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

3. The method of claim 2 , the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

4. The method of claim 1 , further comprising:
monitoring a second plurality of messaging interactions with the messaging system;
determining a plurality of suspicious messaging interactions based on a message content reuse measure;
flagging the plurality of suspicious messaging interactions for review;
receiving a plurality of confirmed scam messaging interactions of the plurality of suspicious messaging interactions; and
including the plurality of confirmed scam messaging interactions in the scam message example repository.

5. The method of claim 1 , further comprising:
collecting a sample of messaging interactions with the messaging system; and
including the sample of messaging interactions in the scam message example repository as example non-scan messages.

6. The method of claim 5 , further comprising:
anonymizing the sample of messaging interactions for inclusion in the scam message example repository.

7. The method of claim 1 , further comprising:
augmenting the sample of messaging interactions based on one or more of user scam reporting, administrator scam flagging, and regular-expression scam-flagging rules.

8. An apparatus, comprising:
an interaction processing component operative to generate a scam message example repository; submit the scam message example repository to a natural-language machine learning component, the natural-language machine learning component to generate a scam message model from the example repository using a message content reuse measure, the content reuse measure to compare a user's reuse of a phrase to the reuse of the phrase in a random message sample; and receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;
an interaction monitoring component operative to monitor a plurality of messaging interactions with a messaging system based on the scam message model; and determine a suspected scam messaging interaction of the plurality of messaging interactions; and
a scam action component operative to perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

9. The apparatus of claim 8 , further comprising:
the interaction monitoring component operative to determine a recognition measure for the suspected scam messaging interaction based on the scam message model; and
the scam action component operative to select the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

10. The apparatus of claim 9 , the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

11. The apparatus of claim 8 , further comprising:
a message reuse monitoring component operative to monitor a second plurality of messaging interactions with the messaging system; determine a plurality of suspicious messaging interactions based on a message content reuse measure; and flag the plurality of suspicious messaging interactions for review; and
the interaction processing component operative to receive a plurality of confirmed scam messaging interactions of the plurality of suspicious messaging interactions; and include the plurality of confirmed scam messaging interactions in the scam message example repository.

12. The apparatus of claim 8 , further comprising:
a message sampling component operative to collect a sample of messaging interactions with the messaging system; and
the interaction processing component operative to include the sample of messaging interactions in the scam message example repository as example non-scan messages.

13. The apparatus of claim 12 , further comprising:
the message sampling component operative to anonymize the sample of messaging interactions for inclusion in the scam message example repository.

14. The apparatus of claim 8 , further comprising:
the interaction processing component operative to augment the sample of messaging interactions based on one or more of user scam reporting, administrator scam flagging, and regular-expression scam-flagging rules.

15. At least one non-transitory computer-readable storage medium comprising instructions that, when executed, cause a system to:
generate a scam message example repository;
submit the scam message example repository to a natural-language machine learning component, the natural-language machine learning component to generate a scam message model from the example repository using a message content reuse measure, the content reuse measure to compare a user's reuse of a phrase to the reuse of the phrase in a random message sample;
receive a scam message model from the natural-language machine learning component in response to submitting the scam message example repository;
monitor a plurality of messaging interactions with a messaging system based on the scam message model;
determine a suspected scam messaging interaction of the plurality of messaging interactions; and
perform a suspected scam messaging action with the messaging system in response to determining the suspected scam messaging interaction.

16. The non-transitory computer-readable storage medium of claim 15 , comprising further instructions that, when executed, cause a system to:
determine a recognition measure for the suspected scam messaging interaction based on the scam message model; and
select the suspected scam messaging action from a plurality of suspected scam messaging actions based on the recognition measure.

17. The non-transitory computer-readable storage medium of claim 16 , the plurality of suspected scam messaging actions comprising two or more of a shadow ban action, an explicit ban action, a scam education action, a scam reporting tool promotion action, and a human review flagging action.

18. The non-transitory computer-readable storage medium of claim 15 , comprising furthe

Assignees

• Facebook Inc

Inventors

• Strauss Emanuel Alexandre
• Saif Farooqui Muhammad
• Muhammad Rehman Mehdi
• Hwang Michelle Ruby
• Scheffer Nicolas
• Rhyu Joseph

Classifications

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06N20/00

  Machine learning · CPC title

• H04L51/12 Primary

  Electricity · mapped topic