Detection of Spoofed Calls Using Call Header

Abstract

Implementations described herein relate to methods, systems, and computer-readable media to label incoming phone calls. A method to label an incoming phone call includes detecting the incoming phone call associated with a caller identifier (ID), determining a location associated with the call, and analyzing a call header of the call to determine one or more call characteristics. The method further includes determining, based on the location and the call characteristics, if the location is spoofed and determining, based on the caller ID and the call characteristics, if an access network associated with the call is spoofed. The method further includes applying a trained machine learning model to determine whether the call is a robocall. The method further includes assigning a label to the call that indicates whether the call is a spoofed call or is the robocall and sending the label to a callee device associated with the call.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 detecting, by at least one hardware processor, an incoming phone call associated with a caller identifier (ID);   determining, by the at least one hardware processor, a location associated with the incoming phone call;   analyzing, by the at least one hardware processor, a call header of the incoming phone call to determine one or more call characteristics;   determining, by the at least one hardware processor, based on the location and the one or more call characteristics, if the location is spoofed; and   providing, by the at least one hardware processor, an indication of whether the incoming phone call is a spoofed call, the indication based on whether the location is spoofed.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein providing the indication of whether the incoming phone call is a spoofed call includes sending the indication from a server to a callee device associated with the incoming phone call. 
     
     
         3 . The computer-implemented method of  claim 2 , wherein analyzing the call header of the incoming phone call comprises determining a route between a caller device associated with the incoming phone call and the server based on route information included in the call header. 
     
     
         4 . The computer-implemented method of  claim 3 , wherein the one or more call characteristics comprise a number of hops between the caller device and the server, wherein determining the route is based on the number of hops, and wherein determining if the location is spoofed comprises:
 retrieving a reference number of hops from a database based at least in part on the route information included in the call header; and   determining that the location is spoofed if the number of hops is different from the reference number of hops.   
     
     
         5 . The computer-implemented method of  claim 3 , wherein determining if the location is spoofed comprises:
 retrieving a reference route from a database based at least in part on the caller ID;   determining whether the route matches the reference route; and   in response to determining that the route does not match the reference route, determining that the location is spoofed.   
     
     
         6 . The computer-implemented method of  claim 5 , further comprising determining respective one or more characteristics of a plurality of intermediate devices in the route based on the call header, and wherein determining whether the route matches the reference route comprises:
 determining a count of the plurality of intermediate devices that have respective one or more characteristics that match characteristics of intermediate devices in the reference route; and   determining that the route matches the reference route if the count of the plurality of the plurality of intermediate devices meets a threshold.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein analyzing the call header of the incoming phone call comprises determining a timezone associated with the incoming phone call, and wherein determining if the location is spoofed comprises:
 determining a caller timezone based on the caller ID; and   determining that the location is spoofed if the timezone associated with the incoming phone call is different from the caller timezone.   
     
     
         8 . The computer-implemented method of  claim 1 , further comprising:
 determining, by the at least one hardware processor, based on the caller ID and the one or more call characteristics, if an access network associated with the incoming phone call is spoofed,   wherein the indication of whether the incoming phone call is the spoofed call is based on whether the location is spoofed and whether the access network associated with the incoming phone call is spoofed.   
     
     
         9 . The computer-implemented method of  claim 8 , wherein analyzing the call header comprises determining, based on the call header, that the incoming phone call is associated with a cellular network, and wherein determining if the access network associated with the incoming phone call is spoofed comprises:
 retrieving a cellular network identifier and a cell identifier from the call header; and   determining that the access network is spoofed if at least one of the cellular network identifier or the cell identifier is missing or erroneous.   
     
     
         10 . The computer-implemented method of  claim 1 , further comprising:
 determining, by the at least one hardware processor, whether the incoming phone call is a robocall based on characteristics of calls indicated in prior call data; and   providing, by the at least one hardware processor, an indication of whether the incoming phone call is the robocall.   
     
     
         11 . The computer-implemented method of  claim 10 , wherein the prior call data includes prior caller ID, prior caller IP address, and prior call route information, wherein the prior call data for one or more prior calls in the prior call data is one or more of:
 indicative of a caller phone number or caller internet protocol (IP) address associated with at least one of: greater than a threshold number of prior outgoing calls in a particular period or multiple consecutive prior outgoing calls;   indicative of a caller phone number that had at least three prior outgoing calls that were simultaneous;   indicative of location spoofing or access network spoofing; or   associated with a spam report.   
     
     
         12 . The computer-implemented method of  claim 2 , wherein the indication is usable by the callee device to provide a user alert that indicates that the incoming phone call is the spoofed call or to automatically handle the incoming phone call. 
     
     
         13 . The computer-implemented method of  claim 2 , wherein receipt of the indication that indicates that the incoming phone call is the spoofed call causes the callee device to:
 provide a user alert that indicates that the incoming phone call is the spoofed call, or   automatically handle the incoming phone call, wherein the automatically handling includes one of: screening the incoming phone call, declining the incoming phone call, or sending the incoming phone call to voicemail.   
     
     
         14 . A non-transitory computer-readable medium with instructions stored thereon that, when executed by one or more hardware processors of a device, cause the one or more hardware processors to perform operations comprising:
 detecting an incoming phone call associated with a caller identifier (ID);   determining a location associated with the incoming phone call;   analyzing a call header of the incoming phone call to determine one or more call characteristics;   determining, based on the location and the one or more call characteristics, if the location is spoofed; and   providing, to a callee device associated with the incoming phone call, an indication of whether the incoming phone call is a spoofed call, the indication based on whether the location is spoofed.   
     
     
         15 . The non-transitory computer-readable medium of  claim 14 , wherein analyzing the call header of the incoming phone call comprises determining a route between a caller device associated with the incoming phone call and a server including the one or more hardware processors, based on route information included in the call header. 
     
     
         16 . The non-transitory computer-readable medium of  claim 15 , wherein the one or more call characteristics comprise a number of hops between the caller device and the server, wherein determining the route is based on the number of hops, and wherein determining if the location is spoofed comprises:
 retrieving a reference number of hops from a database based at least in part on the route information included in the call header; and   determining that the location is spoofed if the number of hops is different from the reference number of hops.   
     
     
         17 . The non-transitory computer-readable medium of  claim 14 , wherein the one or more hardware processors further perform operations comprising:
 determining, based on the caller ID and the one or more call characteristics, if an access network associated with the incoming phone call is spoofed,
 wherein analyzing the call header comprises determining, based on the call header, that the incoming phone call is associated with a cellular network, and wherein determining if the access network associated with the incoming phone call is spoofed comprises: 
   retrieving at least one of a cellular network identifier or a cell identifier from the call header; and   determining that the access network is spoofed if at least one of the cellular network identifier or the cell identifier is missing or erroneous.   
     
     
         18 . The non-transitory computer-readable medium of  claim 14 , wherein the one or more hardware processors further perform operations comprising:
 determining whether the incoming phone call is a robocall based on characteristics of calls indicated in prior call data; and   providing an indication of whether the incoming phone call is the robocall.   
     
     
         19 . A system comprising:
 one or more hardware processors; and   a memory coupled to the one or more hardware processors, with instructions stored thereon, that when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
 detecting an incoming phone call associated with a caller identifier (ID); 
   determining a location associated with the incoming phone call;   analyzing a call header of the incoming phone call to determine one or more call characteristics;   determining, based on the location and the one or more call characteristics, if the location is spoofed; and   providing an indication of whether the incoming phone call is a spoofed call, the indication based on whether the location is spoofed.   
     
     
         20 . The system of  claim 19 , wherein the one or more hardware processors further perform at least one operation of:
 determining, based on the caller ID and the one or more call characteristics, if an access network associated with the incoming phone call is spoofed; or   determining whether the incoming phone call is a robocall based on characteristics of calls indicated in prior call data.