US-12626100-B2 - Messaging account management system

Abstract

Systems and methods for messaging system account management can include receiving an electronic message is originated by a customer account for transmission to a recipient and determining an encoded representation of the electronic message by inputting a numeric representation of the electronic message into an autoencoder. They can further include determining a value reflecting a difference between the encoded representation of the electronic message and encoded representations of the previous messages originated by the customer account and responsive to determining that the value reflecting the difference satisfies a predefined condition, transmitting the electronic message to a recipient.

Inventors

• Sachin Narayan Nagargoje

Assignees

• TWILIO INC.

Dates

Publication Date

20260512

Application Date

20220706

Claims (20)

1. 1 . A method, comprising: receiving, by a processing device, an electronic message for transmission to a recipient, wherein the electronic message is originated by a customer account; determining, by inputting a numeric representation of the electronic message into an autoencoder, an encoded representation of the electronic message, wherein the autoencoder is trained on a plurality of messages originated by the customer account, wherein the autoencoder is trained to minimize a difference between an input of an encoding sub-network of the autoencoder and an output generated by a decoding sub-network of the autoencoder based on an output of the encoding sub-network when processing messages associated with the customer account; determining a value reflecting a difference between the encoded representation of the electronic message produced by the encoding sub-network and encoded representations of the plurality of messages originated by the customer account produced by the encoding sub-network; and responsive to determining that the value reflecting the difference satisfies a predefined condition, transmitting the electronic message to the recipient specified by the electronic message, wherein the predefined condition is based on a threshold value indicating an anomaly in a new electronic message compared to the plurality of messages originated by the customer account.
2. 2 . The method of claim 1 , wherein the predefined condition is satisfied when the value reflecting the difference is less than a predefined threshold value.
3. 3 . The method of claim 1 , wherein the encoded representations of each message of the plurality of messages originated by the customer account comprise a numeric vector encoding of one or more words in a corresponding message of the plurality of messages.
4. 4 . The method of claim 1 , wherein the encoded representations of each message of the plurality of messages originated by the customer account comprise a numeric vector encoding of metadata associated with each message of the plurality of messages in vector space.
5. 5 . The method of claim 1 , wherein determining the value reflecting a difference comprises determining a distance in vector space between the encoded representation of the electronic message and a centroid of a nearest cluster of encoded representations of each message of the plurality of messages.
6. 6 . The method of claim 5 , wherein the value is proportional to the distance.
7. 7 . The method of claim 1 , wherein the electronic message and each message of the plurality of messages comprise metadata and wherein the autoencoder is trained using both message contents and message metadata.
8. 8 . A method comprising: receiving, by a processing device, a plurality of electronic messages originated by a customer account; training an autoencoder by processing the plurality of electronic messages originated by the customer account, wherein the autoencoder is represented by a neural network comprising an encoding sub-network and a decoding sub-network, such that an intermediate representation of each electronic message of the plurality of electronic messages is input into the encoding sub-network, an output of the encoding sub-network is input into the decoding sub-network, and the autoencoder is trained to minimize a difference between an input of the encoding sub-network and an output of the decoding sub-network when processing messages associated with the customer account; and determining, by applying the autoencoder to a new electronic message originated by the customer account, that a value reflecting a difference between an encoded representation of the new electronic message and encoded representations of the plurality of electronic messages originated by the customer account does not satisfy a threshold value, wherein the threshold value indicates an anomaly in the new electronic message compared to the plurality of electronic messages originated by the customer account.
9. 9 . The method of claim 8 , further comprising: storing the plurality of electronic messages originated by the customer account as a message corpus; and removing personally identifiable information from the plurality of electronic messages originated by the customer account prior to training the autoencoder.
10. 10 . The method of claim 8 , wherein the encoded representations of each message of the plurality of electronic messages originated by the customer account comprise numeric vector encodings of one or more words in the message.
11. 11 . The method of claim 8 , further comprising: clustering the respective encoded representation of each message of the plurality of electronic messages in vector space before training the autoencoder.
12. 12 . The method of claim 8 , wherein determining the value reflecting the difference comprises determining a distance in vector space between the encoded representation of the new electronic message and a centroid of a nearest cluster of the encoded representations of the plurality of electronic messages.
13. 13 . The method of claim 12 , wherein the value is proportional to the distance.
14. 14 . The method of claim 8 , wherein the new electronic message and each message of the plurality of electronic messages comprise metadata and wherein the autoencoder is trained using both message contents and message metadata.
15. 15 . A messaging system comprising: a memory device; a processing device, coupled to the memory device, the processing device configured to: receive a plurality of electronic messages originated by a customer account; train an autoencoder by processing the plurality of electronic messages originated by the customer account, wherein the autoencoder is represented by a neural network comprising an encoding sub-network and a decoding sub-network, such that an intermediate representation of each electronic message of the plurality of electronic messages is input into the encoding sub-network, an output of the encoding sub-network is input into the decoding sub-network, and the autoencoder is trained to minimize a difference between an input of the encoding sub-network and an output of the decoding sub-network when processing messages associated with the customer account; and determine, by applying the autoencoder to a new electronic message originated by a customer account, that a value reflecting a difference between an encoded representation of the new electronic message output by the encoding sub-network and encoded representations of the plurality of electronic messages originated by the customer account output by the encoding sub-network does not satisfy a threshold value, wherein the threshold value indicates an anomaly in the new electronic message compared to the plurality of electronic messages originated by the customer account.
16. 16 . The messaging system of claim 15 , wherein the processing device is further configured to: store the plurality of electronic messages originated by the customer account in a message corpus; and remove personally identifiable information from the plurality of electronic messages originated by the customer account prior to training the autoencoder.
17. 17 . The messaging system of claim 15 , wherein the encoded representations of each message of the plurality of electronic messages originated by the customer account comprise numeric vector encodings of one or more words in the message.
18. 18 . The messaging system of claim 15 , wherein training the autoencoder comprises clustering the encoded representations of each message of the plurality of electronic messages in vector space.
19. 19 . The messaging system of claim 15 , wherein determining the value reflecting the difference comprises determining a distance in vector space between the encoded representation of the new electronic message and a centroid of a nearest cluster of the encoded representations of the plurality of electronic messages.
20. 20 . The messaging system of claim 19 , wherein the value is proportional to the distance and wherein the electronic message and each message of the plurality of electronic messages comprise metadata.

Description

TECHNICAL FIELD The implementations of the disclosure relate generally to computer systems and, more specifically, to systems and methods for messaging account management in messaging systems. BACKGROUND Messaging systems have become ubiquitous for individuals and customers to communicate with large numbers of message recipients. Such systems can be used as mass messaging systems that incorporate instant messaging (IM) technology that permits real-time transmission of content over a network; email messaging technology that permits structured data to be transmitted in a digital form analogous to physical letters; as well as Short Messaging Service (SMS) and Multimedia Messaging Service (MMS) messaging capabilities that permit short text messages to be transmitted between two or more parties. BRIEF DESCRIPTION OF THE DRAWINGS The disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various implementations of the disclosure. The drawings, however, should not be taken to limit the disclosure to the specific implementations, but are for explanation and understanding only. FIG. 1 is a block diagram of a communications system, in accordance with an implementation of the present disclosure; FIG. 2 is a schematic diagram of an example system architecture, in accordance with an implementation of the present disclosure; FIG. 3 is a diagram of an example method for account verification and remediation, in accordance with some implementations of the present disclosure; FIG. 4 is a diagram of an example method for autoencoder training and scoring, in accordance with some implementations of the present disclosure; FIG. 5A is a diagram of an example method for message filtering, in accordance with some implementations of the present disclosure; FIG. 5B is a diagram of an example method for autoencoder training and application, in accordance with some implementations of the present disclosure; FIG. 6 is a schematic illustration of an example autoencoder, in accordance with some implementations of the present disclosure; and FIG. 7 is a block diagram of an illustrative computing device, in accordance with some implementations of the present disclosure. DETAILED DESCRIPTION Implementations of the present disclosure are directed to mechanisms for account verification and for the performance of remedial actions in response to potential account takeover events. Various messaging systems that provide email messaging services, text and media messaging services such as Short Messaging Service (SMS) and Multimedia Messaging Service (MMS), and instant messaging (IM) services often have accounts that associate a customer with messaging and other data that are sent through the services of the system. While customers of such systems can be individuals, they can also be companies, organizations, and similar large enterprises that use messaging services provided by such systems to transmit messages to large numbers of recipients on a recurring basis over extended periods of time. The messages and their contents can be varied and can be sent for different purposes. For example, in some cases the customer can send messages to recipients containing notifications and informational updates, while in others, the customer can send messages containing confirmations or clarifications regarding services that have been provided by the customers to the recipients of the messages. The messages sent out by the customers can be part of periodic messaging campaigns or can be a part of a regular recurring communication stream. Since such systems can be accessed through accounts, each account can be associated with a particular customer and permit the customers to access the features of the systems enabling the customer to conduct their messaging activities. Accounts can be associated with messages that are sent and received by the respective customers and can help track their activities on the system. However, malicious actors can gain access to accounts that do not belong to them and undertake activities under the guise of the actual account holder. Entities that take over other customers' accounts can send messages to recipients that can include illegal, fraudulent, malicious, or otherwise undesirable content. For example, a malicious party can obtain the account access credentials and utilize the customer account for unauthorized email transmissions (“spam”). Manual identification of account takeovers (e.g., detection of compromised accounts and unauthorized activities) that take place with respect to a customer is a labor intensive and time-consuming process. Further, it is often difficult for an individual to manually determine whether a change in a customer's messaging activity is sufficient to indicate that an account has been taken over and therefore requires additional investigation or verification or whether remedial action needs to be taken for a customer account. This results