Cognitive Security for Voice Phishing Activity

Abstract

An approach is provided in which a question answer system monitors a voice conversation between a first entity and a second entity. During the conversation, the question answer system parses the conversation into information phrases, and constructs the information phrases into a current conversation pattern. The question answer system identifies deceptive conversation properties of the current conversation by analyzing the current conversation pattern against domain-based conversation patterns. The question answer system, in turn, sends an alert message to the first entity to notify the first entity of the identified deceptive conversation properties.

1 . (canceled) 
     
     
         2 . (canceled) 
     
     
         3 . (canceled) 
     
     
         4 . (canceled) 
     
     
         5 . (canceled) 
     
     
         6 . (canceled) 
     
     
         7 . (canceled) 
     
     
         8 . (canceled) 
     
     
         9 . (canceled) 
     
     
         10 . An information handling system comprising:
 one or more processors;   a memory coupled to at least one of the processors; and   a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
 generating a plurality of information elements based upon a voice conversation between a first entity and a second entity over a communication network; 
 constructing a current conversation pattern from the plurality of information elements; 
 identifying one or more deceptive conversation properties of the current conversation pattern based upon analyzing the current conversation pattern against one or more domain-based conversation patterns; and 
 sending an alert message to the first entity based upon the identified one or more deceptive conversation properties. 
   
     
     
         11 . The information handling system of  claim 10  wherein the voice conversation comprises one or more conversation statements, the one or more processors performing additional actions comprising:
 parsing the one or more conversation statements into a plurality of information phrases based upon cognitive analysis of the one or more conversation statements by a question answer system, wherein the plurality of information elements are generated from the plurality of information phrases; 
 determining an order of the plurality of information elements based upon a relative order of the plurality of information phrases in the voice conversation; 
 storing the plurality of information elements in the determined order into the current conversation pattern; 
 generating a suspicion score based upon comparing the ordered plurality of information elements against one or more valid element orders corresponding to at least one of the one or more domain-based conversation patterns; and 
 generating the alert message in response to determining that the suspicion score reaches a suspicion threshold. 
 
     
     
         12 . The information handling system of  claim 10  wherein the one or more processors perform additional actions comprising:
 retrieving sensitive data corresponding to a first entity user of the first entity; 
 generating a validation question based upon the retrieved sensitive data, wherein the validation question is configured to be asked by the first entity to validate a second entity user of the second entity; 
 sending the validation question to the first entity; 
 receiving an validation answer from the second entity in response to the first entity user asking the validation question to the second entity user; 
 determining whether the second entity is a deceptive entity based upon analyzing the received answer against the sensitive data; and 
 notifying the first entity based upon the determination. 
 
     
     
         13 . The information handling system of  claim 10  wherein the one or more processors perform additional actions comprising:
 ingesting a conversation pattern corpora that includes a plurality of documents; and 
 generating a conversation pattern domain based upon the plurality of documents, wherein the conversation pattern domain comprises a set of valid conversation patterns and a set of deceptive conversation patterns, and wherein the one or more domain-based conversation patterns are included in the conversation pattern domain. 
 
     
     
         14 . The information handling system of  claim 10  wherein the one or more processors perform additional actions comprising:
 sending the alert message to a client device selected from the group consisting of a mobile phone, a landline phone, a television, and a computer system. 
 
     
     
         15 . The information handling system of  claim 10  wherein the one or more processors perform additional actions comprising:
 detecting that the first entity is attempting to provide sensitive content to the second entity; 
 prohibiting the sensitive content from being provided to the second entity; 
 sending a request to the first entity to authorize sending the sensitive content to the second entity; and 
 terminating the voice conversation in response to not receiving an authorization from the first entity. 
 
     
     
         16 . A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:
 generating a plurality of information elements based upon a voice conversation between a first entity and a second entity over a communication network;   constructing a current conversation pattern from the plurality of information elements;   identifying one or more deceptive conversation properties of the current conversation pattern based upon analyzing the current conversation pattern against one or more domain-based conversation patterns; and   sending an alert message to the first entity based upon the identified one or more deceptive conversation properties.   
     
     
         17 . The computer program product of  claim 16  wherein the voice conversation comprises one or more conversation statements, the information handling system performing additional actions comprising:
 parsing the one or more conversation statements into a plurality of information phrases based upon cognitive analysis of the one or more conversation statements by a question answer system, wherein the plurality of information elements are generated from the plurality of information phrases; 
 determining an order of the plurality of information elements based upon a relative order of the plurality of information phrases in the voice conversation; 
 storing the plurality of information elements in the determined order into the current conversation pattern; 
 generating a suspicion score based upon comparing the ordered plurality of information elements against one or more valid element orders corresponding to at least one of the one or more domain-based conversation patterns; and 
 generating the alert message in response to determining that the suspicion score reaches a suspicion threshold. 
 
     
     
         18 . The computer program product of  claim 16  wherein the information handling system performs additional actions comprising:
 retrieving sensitive data corresponding to a first entity user of the first entity; 
 generating a validation question based upon the retrieved sensitive data, wherein the validation question is configured to be asked by the first entity to validate a second entity user of the second entity; 
 sending the validation question to the first entity; 
 receiving an validation answer from the second entity in response to the first entity user asking the validation question to the second entity user; 
 determining whether the second entity is a deceptive entity based upon analyzing the received answer against the sensitive data; and 
 notifying the first entity based upon the determination. 
 
     
     
         19 . The computer program product of  claim 16  wherein the information handling system performs additional actions comprising:
 ingesting a conversation pattern corpora that includes a plurality of documents; and 
 generating a conversation pattern domain based upon the plurality of documents, wherein the conversation pattern domain comprises a set of valid conversation patterns and a set of deceptive conversation patterns, and wherein the one or more domain-based conversation patterns are included in the conversation pattern domain. 
 
     
     
         20 . The computer program product of  claim 16  wherein the information handling system performs additional actions comprising:
 detecting that the first entity is attempting to provide sensitive content to the second entity; 
 prohibiting the sensitive content from being provided to the second entity; 
 sending a request to the first entity to authorize sending the sensitive content to the second entity; and 
 terminating the voice conversation in response to not receiving an authorization from the first entity.