# US 11,451,962 B2 · Network-based protection against scam applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,962 B2 - Document ID: US11451962B2 - Status: Granted - Kind: B2 - Application number: 15/931,480 - Filed: 2020-05-13 - Published: 2021-11-18 - Granted: 2022-09-20 - Earliest claimed: 2020-05-13 - Assignees: T-Mobile USA, Inc. - Applicants: T-Mobile USA, Inc. - Inventors: Ahmad Arash Obaidi - Web page: https://patentgrep.com/patent/US11451962B2 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - G06F 8/62: {Uninstallation} - G06N 5/04: Inference or reasoning models - G06N 20/00: Machine learning - G06Q 30/0185: {Product, service or business identity fraud} - G06Q 30/04: Billing or invoicing - G06Q 50/265: {Personal security, identity or safety} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04M 15/04: Recording calls {, or communications} in printed, perforated or other permanent form - H04M 15/06: Recording class or number of calling {, i.e. A-party} or called party {, i.e. B-party} - H04M 15/47: {Fraud detection or prevention means} - H04M 15/888: {severing connection after predetermined time or data} - H04W 4/24: Accounting or billing - H04W 12/08: Access security - H04W 12/12: Detection or prevention of fraud - H04W 4/12: Messaging; Mailboxes; Announcements - H04W 88/02: Terminal devices - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract Outgoing communications from a user device are monitored following a notification that an application is installed on a user device. When a number of the outgoing communications to a premium-rate number during a predetermined period of time exceeds a corresponding quantity threshold, the pattern of the outgoing communications may be ascertained to be anomalous. A user device is directed to present a prompt that requests an input as to whether the outgoing communications are authorized. In response to a first input that the outgoing communications are unauthorized, additional outgoing communications from the user device to the premium-rate number are blocked for a predesignated amount of time. Further, the first input is stored as a corresponding vote that the application is malicious. In response to a second input that the outgoing communications are authorized, the second input is stored as a corresponding vote that the application is non-malicious. ## Claims ### Claim 1 One or more non-transitory computer-readable media of a core network of a wireless carrier network storing computer-executable instructions that upon execution cause one or more processors to perform acts comprising: monitoring outgoing communications from a user device following a notification that an application is installed on a user device, the outgoing communications including at least one of one or more voice calls or one or more messages to a premium-rate number; determining that a number of the outgoing communications to the premium-rate number during a predetermined period of time exceeded a corresponding quantity threshold; ascertaining, via a pattern matching algorithm or a machine-learning algorithm, that a pattern of the outgoing communications for which the number exceed the corresponding quantity threshold during the predetermined period of time is an anomalous pattern; directing the user device to present a prompt that requests an input at the user device as to whether the outgoing communications are authorized as a result of the pattern fitting the anomalous pattern; in response to a first input from the user device indicating that the outgoing communications to the premium-rate number are unauthorized, blocking additional outgoing communications from the user device to the premium-rate number for a predesignated amount of time, and storing the first input as a corresponding vote that the application is malicious; and in response to a second input from the user device indicating that the outgoing communications to the premium-rate number are authorized, storing the second input as a corresponding vote that the application is non-malicious. ### Claim 2 (depends on 1) The one or more non-transitory computer-readable media of claim 1, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold, directing the user device to present a recommendation to remove the application from the user device. ### Claim 3 (depends on 1) The one or more non-transitory computer-readable media of claim 1, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and determining that the application is installed on an additional user device, directing the additional user device to present a recommendation to remove the application from the additional user device. ### Claim 4 (depends on 1) The one or more non-transitory computer-readable media of claim 1, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and detecting that the application is newly installed on one or more user devices, directing the one or more user devices to present one or more corresponding recommendations to remove the application from the one or more user devices. ### Claim 5 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the prompt includes a cost summary of fees that are incurred for the outgoing communications to the premium-rate number. ### Claim 6 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the ascertaining includes classifying the pattern into a class of a plurality of classes that corresponds to multiple anomalous patterns, or labeling the pattern as the anomalous pattern when the pattern deviates from a comparable pattern of a previous corresponding period of a time by at least a predetermined deviation value. ### Claim 7 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the acts further comprise refining the machine-learning algorithm based on the pattern of the outgoing communications being designated as anomalous. ### Claim 8 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the one or more messages include a Short Message Service (SMS) message, a Rich Communication Services (RCS) message, or a Multimedia Messaging Service (MMS) message. ### Claim 9 A system, comprising: one or more processors; and memory including a plurality of computer-executable components that are executable by the one or more processors to perform a plurality of actions, the plurality of actions comprising: monitoring outgoing communications from a user device following a notification that an application is installed on a user device, the outgoing communications including at least one of one or more voice calls or one or more messages to an emergency services number; determining that a number of the outgoing communications to the emergency services number during a predetermined period of time exceeded a corresponding quantity threshold; ascertaining, via a pattern matching algorithm or a machine-learning algorithm, that a pattern of the outgoing communications for which the number exceed the corresponding quantity threshold during the predetermined period of time is an anomalous pattern; directing the user device to present a prompt that requests an input at the user device as to whether the outgoing communications are authorized as a result of the pattern fitting the anomalous pattern; in response to a first input from the user device indicating that the outgoing communications to the emergency services number are not authorized, directing the user device to present a recommendation to remove the application from the user device, and storing the first input as a corresponding vote that the application is malicious; and in response to a second input from the user device indicating that the outgoing communications to the emergency services number are authorized, storing the second input as a corresponding vote that the application is non-malicious. ### Claim 10 (depends on 9) The system of claim 9, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and determining that the application is installed on an additional user device, directing the additional user device to present a recommendation to remove the application from the additional user device. ### Claim 11 (depends on 9) The system of claim 9, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and detecting that the application is newly installed on one or more user devices, directing the one or more user devices to present one or more corresponding recommendations to remove the application from the one or more user devices. ### Claim 12 (depends on 9) The system of claim 9, wherein the ascertaining includes classifying the pattern into a class of a plurality of classes that corresponds to multiple anomalous patterns, or labeling the pattern as the anomalous pattern when the pattern deviates from a comparable pattern of a previous corresponding period of a time by at least a predetermined deviation value. ### Claim 13 (depends on 9) The system of claim 9, wherein the acts further comprise refining the machine-learning algorithm based on the pattern of the outgoing communications being designated as anomalous. ### Claim 14 (depends on 9) The system of claim 9, wherein the one or more messages include a Short Message Service (SMS) message, a Rich Communication Services (RCS) message, or a Multimedia Messaging Service (MMS) message. ### Claim 15 A computer-implemented method, comprising: monitoring, via one or more computing nodes, outgoing communications from a user device following a notification that an application is installed on a user device, the outgoing communications including at least one of one or more voice calls or one or more messages to a premium-rate number; determining, via the one or more computing nodes, that a number of the outgoing communications to the premium-rate number during a predetermined period of time exceeded a corresponding quantity threshold; ascertaining, via a pattern matching algorithm or a machine-learning algorithm that is executed by the one or more computing nodes, that a pattern of the outgoing communications for which the number exceed the corresponding quantity threshold during the predetermined period of time is an anomalous pattern; directing, via the one or more computing nodes, the user device to present a prompt that requests an input at the user device as to whether the outgoing communications are authorized as a result of the pattern fitting the anomalous pattern; in response to a first input from the user device indicating that the outgoing communications to the premium-rate number are unauthorized, blocking, via the one or more computing nodes, additional outgoing communications from the user device to the premium-rate number for a predesignated amount of time, and storing the first input as a corresponding vote that the application is malicious; and in response to a second input from the user device indicating that the outgoing communications to the premium-rate number are authorized, storing, via the one or more computing nodes, the second input as a corresponding vote that the application is non-malicious. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold, directing the user device to present a recommendation to remove the application from the user device. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and determining that the application is installed on an additional user device, directing the additional user device to present a recommendation to remove the application from the additional user device. ### Claim 18 (depends on 15) The computer-implemented method of claim 15, further comprising, in response to a percentage of votes designating the application as malicious at least meeting a predetermined percentage threshold and detecting that the application is newly installed on one or more user devices, directing the one or more user devices to present one or more corresponding recommendations to remove the application from the one or more user devices.