# US 12,764,085 B2 · Conversational message spam detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,085 B2 - Document ID: US12764085B2 - Status: Granted - Kind: B2 - Application number: 18/915,282 - Filed: 2024-10-14 - Published: 2025-03-13 - Granted: 2026-10-13 - Earliest claimed: 2023-09-12 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Alexander Bobotek - Web page: https://patentgrep.com/patent/US12764085B2 ## CPC - H04L 51/212: using filtering or selective blocking - H04L 51/04: Real-time or near real-time messaging, e.g. instant messaging [IM] - H04L 51/224: providing notification on incoming messages, e.g. pushed notifications of received messages - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A processing system may identify a plurality of message contents within a plurality of reported messages, where each is reported as an unwanted message, determine, for each message content, a respective count comprising a number of occurrences the message content within the plurality of reported messages, identify a set of message contents within the plurality of message contents for which associated counts of the plurality of counts exceeds a first threshold, identify a source phone number that is a source of a first set of messages within the plurality of reported messages containing one or more message contents of the set of message contents, and where a number of reporting entities associated with the first set of messages exceeds at least a second threshold, and perform at least one remedial action in a communication network in response to the identifying of the source phone number. ## Claims ### Claim 1 A method comprising: identifying, by a processing system including at least one processor, within a plurality of reported messages, a plurality of message contents, wherein each reported message of the plurality of reported messages is reported as an unwanted message; determining, by the processing system, for each respective message content of the plurality of message contents, a respective count of a plurality of counts, the respective count comprising a number of occurrences of the respective message content within the plurality of reported messages; identifying, by the processing system, a set of message contents within the plurality of message contents for which each of associated counts of the plurality of counts exceeds a first threshold; identifying, by the processing system, at least one source account identifier that is a source of a first set of messages within the plurality of reported messages containing one or more message contents of the set of message contents, and where a number of reporting entities associated with the first set of messages exceeds at least a second threshold; and performing, by the processing system, at least one remedial action in a communication network in response to the identifying of the at least one source account identifier. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of reported messages comprises messages reported within a defined time period. ### Claim 3 (depends on 1) The method of claim 1, wherein the at least one remedial action comprises at least one of: blocking messages of the at least one source account identifier via the communication network; adding the at least one source account identifier to a list of malicious sources; or transmitting a notification to at least one source network associated with the at least one source account identifier of an identification of the at least one source account identifier as a malicious source. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least the second threshold comprises a plurality of thresholds including at least two of: a threshold associated with a number of reporting entities per source; a threshold associated with a number of reporting entities per source and for which a time span over which reported messages of a given source are reported exceeds a threshold time period; or a threshold associated with a number of reporting entities per source for messages that exclude one or more message contents from among the plurality of message contents having highest counts from among the plurality of counts. ### Claim 5 (depends on 1) The method of claim 1, wherein the plurality of reported messages comprises messages associated with at least one selected source network. ### Claim 6 (depends on 5) The method of claim 5, wherein the at least one selected source network is designated as being associated with a high volume of unwanted messages. ### Claim 7 (depends on 5) The method of claim 5, further comprising: extracting the plurality of reported messages from a set of reported messages associated with at least one of a plurality of source networks. ### Claim 8 (depends on 1) The method of claim 1, wherein for the each respective message content of the plurality of message contents, the respective count of the plurality of counts comprises the number of occurrences of the respective message content within the plurality of reported messages and a count modifier based upon a similarity measure of one or more other message contents of the plurality of message contents. ### Claim 9 (depends on 8) The method of claim 8, wherein the similarity measure comprises a distance measure based upon embeddings of the respective message content and the one or more other message contents. ### Claim 10 (depends on 1) The method of claim 1, further comprising: generating at least one score for the at least one source account identifier, the at least one score based on a number of messages of the first set of messages. ### Claim 11 (depends on 10) The method of claim 10, wherein the at least one score is further based on a number of independent reporting entities reporting the first set of messages from among the plurality of reported messages associated with the at least one source account identifier. ### Claim 12 (depends on 10) The method of claim 10, wherein the at least one score is further based on at least one of: a message volume or a message frequency of the at least one source account identifier within a defined time period associated with the plurality of reported messages. ### Claim 13 (depends on 10) The method of claim 10, wherein the performing of the at least one remedial action is further in response to the at least one score. ### Claim 14 (depends on 13) The method of claim 13, wherein the at least one remedial action comprises providing the at least one score as an input to at least one malicious activity detection model. ### Claim 15 (depends on 1) The method of claim 1, further comprising: excluding, from the set of message contents, at least one message content that is identified as being associated with a non-conversational spam activity. ### Claim 16 (depends on 15) The method of claim 15, wherein the at least one message content is identified as being associated with a marketing activity in accordance with a classification model for detecting marketing activity in messages. ### Claim 17 (depends on 15) The method of claim 15, further comprising: identifying a number of response messages for which the at least one source account identifier is a recipient within a defined time period associated with the plurality of reported messages. ### Claim 18 (depends on 17) The method of claim 17, wherein the at least one remedial action comprises at least one of: adding the at least one source account identifier to a list of conversational spam sources, when a threshold associated with the number of response messages is exceeded; or transmitting a notification to at least one source network associated with the at least one source account identifier of an identification of the at least one source account identifier as a conversational spam source, when the threshold associated with the number of response messages is exceeded. ### Claim 19 A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising: identifying within a plurality of reported messages, a plurality of message contents, wherein each reported message of the plurality of reported messages is reported as an unwanted message; determining, for each respective message content of the plurality of message contents, a respective count of a plurality of counts, the respective count comprising a number of occurrences of the respective message content within the plurality of reported messages; identifying a set of message contents within the plurality of message contents for which each of associated counts of the plurality of counts exceeds a first threshold; identifying at least one source account identifier that is a source of a first set of messages within the plurality of reported messages containing one or more message contents of the set of message contents, and where a number of reporting entities associated with the first set of messages exceeds at least a second threshold; and performing at least one remedial action in a communication network in response to the identifying of the at least one source account identifier. ### Claim 20 An apparatus comprising: a processing system including at least one processor; and a computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising: identifying within a plurality of reported messages, a plurality of message contents, wherein each reported message of the plurality of reported messages is reported as an unwanted message; determining, for each respective message content of the plurality of message contents, a respective count of a plurality of counts, the respective count comprising a number of occurrences of the respective message content within the plurality of reported messages; identifying a set of message contents within the plurality of message contents for which each of associated counts of the plurality of counts exceeds a first threshold; identifying at least one source account identifier that is a source of a first set of messages within the plurality of reported messages containing one or more message contents of the set of message contents, and where a number of reporting entities associated with the first set of messages exceeds at least a second threshold; and performing at least one remedial action in a communication network in response to the identifying of the at least one source account identifier.