# US 2025/0097341 A1 · Malicious call attack detection and mitigation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097341 A1 - Document ID: US20250097341A1 - Status: Published application - Kind: A1 - Application number: 18/469,370 - Filed: 2023-09-18 - Published: 2025-03-20 - Earliest claimed: 2023-09-18 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Gaurav SINGH; Sridhar ANUMALA; Subrato Kumar DE; Mugdha Sanjay PATIL; Ankur BHATTACHARJEE - Web page: https://patentgrep.com/patent/US20250097341A1 ## CPC - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04W 12/61: Time-dependent - H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)} - H04M 3/4365: {based on information specified by the calling party, e.g. priority or subject} - H04M 7/0078: {Security; Fraud detection; Fraud prevention} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04M 3/42059: {Making use of the calling party identifier} - H04M 2203/6027: Fraud preventions - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and techniques are provided for wireless communications. A process can include determining that a quantity of a plurality of Mobile Terminated (MT) calls received within a first time period is greater than a first configured threshold. A process can include determining a subset of non-verified MT calls from the plurality of MT calls based on a call verification score for each respective MT call of the plurality of MT calls received within the first time period. A process can include determining that a quantity of non-verified MT calls included in the subset is greater than a second configured threshold. A process can include performing modem-level blocking based on determining a corresponding calling party identity associated with a non-verified MT call included in the subset. ## Claims ### Claim 1 An apparatus of a user equipment (UE) for wireless communication, comprising: a memory; and a processor coupled to the memory, wherein the processor is configured to: determine that a quantity of a plurality of Mobile Terminated (MT) calls received within a first time period is greater than a first configured threshold; determine a subset of non-verified MT calls from the plurality of MT calls based on a call verification score for each respective MT call of the plurality of MT calls received within the first time period; determine that a quantity of non-verified MT calls included in the subset is greater than a second configured threshold; and perform modem-level blocking based on determining a corresponding calling party identity associated with a non-verified MT call included in the subset. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the apparatus further comprises a modem, and wherein, to perform modem-level blocking, the at least one processor is configured to blacklist the corresponding calling party identity using the modem. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein, to perform modem-level blocking, the at least one processor is configured to: perform modem-level blocking of a corresponding calling party identity associated with each respective non-verified MT call included in the subset. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: determine an elapsed time from implementation of the modem-level blocking in a modem of the UE; and compare the elapsed time to a configured time threshold value. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the processor is further configured to: maintain the modem-level blocking for the corresponding calling party identity associated with each respective non-verified MT call, based on the elapsed time being less than the configured time threshold value. ### Claim 6 (depends on 4) The apparatus of claim 4, wherein the processor is further configured to: remove the modem-level blocking for the corresponding calling party identity associated with each respective non-verified MT call, based on the elapsed time being greater than the configured time threshold value. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the first time period comprises a sliding time window with a configured length. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the processor is further configured to: remove the modem-level blocking based on a determination that a configured timer value has expired; and increment a call flow counter, wherein a value of the call flow counter is indicative of a number of times modem-level blocking has been performed. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the first configured threshold comprises a configured quantity divided by the call flow counter. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: store history information indicative of the corresponding calling party identity associated with each respective non-verified MT call associated with the modem-level blocking. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the processor is further configured to: receive a subsequent MT call associated with a respective calling party identity; compare the respective calling party identity to the history information; and based on a determination that the respective calling party identity is included in the history information, perform modem-level blocking of the respective calling party identity without determining a call verification score for the subsequent MT call. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the processor is further configured to: perform modem-level blocking of the respective calling party identity for a first length of time based on the respective calling party identity not being included in the history information; and perform modem-level blocking of the respective calling party identity for a second length of time based on the respective calling party identity being included in the history information, wherein the second length of time is greater than the first length of time. ### Claim 13 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: determine an elapsed time from a first instance of the modem-level blocking; compare the elapsed time to a third time threshold, wherein the third time threshold is a configured random value; and remove the modem-level blocking based on the elapsed time being greater than the configured random value of the third time threshold. ### Claim 14 (depends on 1) The apparatus of claim 1, wherein the first configured threshold comprises a configured detection threshold corresponding to a silent MT call attack. ### Claim 15 (depends on 1) The apparatus of claim 1, wherein, to determine the call verification score for each respective MT call, the processor is configured to: analyze respective calling party identity information associated with each respective MT call of the plurality of MT calls, wherein the respective calling party identity information is included in a session initiation protocol (SIP) INVITE request corresponding to the respective MT call. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the respective calling party identity information is included in one or more security identity headers of the SIP INVITE request corresponding to the respective MT call. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the one or more security identity headers include at least one of a P-Asserted-Identity header or a verstat field. ### Claim 18 A method for wireless communication by a user equipment (UE), the method comprising: determining that a quantity of a plurality of Mobile Terminated (MT) calls received within a first time period is greater than a first configured threshold; determining a subset of non-verified MT calls from the plurality of MT calls based on a call verification score for each respective MT call of the plurality of MT calls received within the first time period; determining that a quantity of non-verified MT calls included in the subset is greater than a second configured threshold; and performing modem-level blocking based on determining a corresponding calling party identity associated with a non-verified MT call included in the subset. ### Claim 19 (depends on 18) The method of claim 18, wherein the modem-level blocking is performed using a modem of the UE, and wherein performing modem-level blocking comprises using the modem of the UE to blacklist the corresponding calling party identity. ### Claim 20 (depends on 18) The method of claim 18, wherein performing modem-level blocking comprises: performing modem-level blocking of a corresponding calling party identity associated with each respective non-verified MT call included in the subset. ### Claim 21 (depends on 18) The method of claim 18, further comprising: determining an elapsed time from implementation of the modem-level blocking in a modem of the UE; and comparing the elapsed time to a configured time threshold value. ### Claim 22 (depends on 21) The method of claim 21, further comprising: maintaining the modem-level blocking for the corresponding calling party identity associated with each respective non-verified MT call, based on the elapsed time being less than the configured time threshold value. ### Claim 23 (depends on 21) The method of claim 21, further comprising: removing the modem-level blocking for the corresponding calling party identity associated with each respective non-verified MT call, based on the elapsed time being greater than the configured time threshold value. ### Claim 24 (depends on 18) The method of claim 18, wherein the first time period comprises a sliding time window with a configured length. ### Claim 25 (depends on 24) The method of claim 24, further comprising: removing the modem-level blocking based on a determination that a configured timer value has expired; and incrementing a call flow counter, wherein a value of the call flow counter is indicative of a number of times modem-level blocking has been performed. ### Claim 26 (depends on 25) The method of claim 25, wherein the first configured threshold comprises a configured quantity divided by the call flow counter. ### Claim 27 (depends on 18) The method of claim 18, further comprising: storing history information indicative of the corresponding calling party identity associated with each respective non-verified MT call associated with the modem-level blocking. ### Claim 28 (depends on 27) The method of claim 27, further comprising: receiving a subsequent MT call associated with a respective calling party identity; comparing the respective calling party identity to the history information; and based on a determination that the respective calling party identity is included in the history information, performing modem-level blocking of the respective calling party identity without determining a call verification score for the subsequent MT call. ### Claim 29 (depends on 28) The method of claim 28, further comprising: performing modem-level blocking of the respective calling party identity for a first length of time based on the respective calling party identity not being included in the history information; and performing modem-level blocking of the respective calling party identity for a second length of time based on the respective calling party identity being included in the history information, wherein the second length of time is greater than the first length of time. ### Claim 30 (depends on 18) The method of claim 18, further comprising: determining an elapsed time from a first instance of the modem-level blocking; comparing the elapsed time to a third time threshold, wherein the third time threshold is a configured random value; and removing the modem-level blocking based on the elapsed time being greater than the configured random value of the third time threshold.