Spam filtering: how spam calls are detected and stopped automatically

What is spam filtering

Spam filtering is a system that detects spam calls on its own and stops them. The difference from a regular block is who decides. With a regular list, a person adds a number after it has already been a nuisance. With spam filtering, the system identifies the number by what it does, and sometimes even before it reaches you.

To do this, the system does not need to know in advance who is calling. It looks at two things: how the number behaves, and what is said on its calls. A number that behaves like an autodialer, and whose calls sound like advertising, is almost certainly spam.

This is sometimes also called "automatic call filtering". The idea is the same: the system decides on its own, by fixed rules, what to do with each call, without anyone having to check every number themselves. And because the rules are fixed, the decision is the same at any hour, even at night and on Friday evening, when there is no one in the office to answer.

Spam filtering does not replace lists. It complements them. A list works well against a fixed number that keeps bothering you. Spam filtering works well against numbers that keep changing, which no list can keep up with. For the spam calls themselves, what they are and how to recognize them when you answer, there is a separate article on spam calls.

Why a blacklist is not enough

The traditional way to deal with spam is a blacklist: a number that was a nuisance goes on the list and does not get through anymore. Against a call center that always calls from the same number, this works.

But most spam calls do not work this way. An autodialer can change its number every day, and sometimes every hour. By the time someone notices and adds the number to the list, the autodialer has already called everyone and moved on to the next number.

There is also a timing problem. With a regular list, someone has to take the call, realize it is spam, write down the number and add it. All of this happens after the call has already been a nuisance. Spam filtering tries to stop the number earlier: after it has started behaving like an autodialer, and before it has reached everyone.

Two ways to detect spam: behavior and content

There are two questions a system can ask about a number:

Each method alone is partial. Behavior is fast, but can be wrong. Content is more accurate, but slower. In Kesher's filtering service, behavior triggers a fast, temporary block today, and the service manager decides whether it stays. Coming soon, content too: automatic analysis of one of the number's calls will decide whether the block stays.

The dialing pattern: what gives an autodialer away

A regular person usually doesn't call 10 different numbers within 10 minutes. Even a very busy employee returning calls all morning talks to each person for a few minutes. An autodialer, on the other hand, dials many numbers at once.

This is the basis of the service's first rule: an outside caller who calls 10 different numbers within 10 minutes is suspected of spam.

Two details in this rule matter:

• Different numbers. What is counted is how many different numbers received a call, not how many calls there were. Someone who calls the same number again and again may be a persistent caller, but is not an autodialer.
• Across the whole PBX. The count is done across the whole PBX, not just for one customer. A single customer sees one or two calls from the number and suspects nothing. The PBX sees all of its calls together, so it sees the pattern.
• Only outside callers. Numbers of Kesher customers, and numbers the service manager has set as protected, are not counted.

The threshold: balancing speed and caution

Every automatic rule needs a threshold: the point at which a number is considered suspicious. And every threshold involves a balance.

• A threshold that is too low will also flag regular callers, for example someone who returns several calls in a row. More innocent numbers will be blocked for a short time, even if they are released in the end.
• A threshold that is too high will let an autodialer reach many people before it is stopped.

In Kesher's filtering service, the threshold is 10 different numbers within 10 minutes. And since the first block is temporary, and ends after an hour unless the service manager decides on a permanent block, the damage is limited in time even when the threshold catches an innocent number.

Temporary block: a quick stop

When a number crosses the threshold, the service does not wait. The number is blocked immediately, temporarily, for an hour, for everyone who has subscribed to the service.

Why immediately? Because an autodialer works fast. If the service waited to decide, the autodialer would manage to call many more numbers. An immediate block stops it midway.

And why temporary? Because a dialing pattern alone doesn't yet tell you what was said in the call. It may be spam, and it may not. So the first block is temporary: after an hour it ends, and the number waits for the service manager's decision, a permanent block or a release. Coming soon, the service will also check the content of one of the number's calls during this time.

The block applies to all subscribers at once. That is the advantage of a shared service: a number that started calling other customers is stopped for you too, even before it reaches you.

Content analysis: what was said in the call (coming soon)

Coming soon — this part is not working yet. Today, after the temporary block, the decision is the service manager's. Once the analysis is built, during the temporary block the service will automatically analyze the content of one of the number's calls: it will transcribe it and check what was said.

The question is simple: is this a spam call? For example, advertising, a survey, a recorded message or a sales pitch.

• If so, the block will become permanent, for all subscribers.
• If not, the number will be released, and its calls will go through as usual.

This way, the final decision will not rest only on how many calls there were, but also on what was in them. A service center that calls back everyone who left a message overnight, for example, can cross the threshold. When its call is analyzed, it will turn out not to be a spam call, and it will be released.

You can read about call transcription and how it works in the article on call transcription.

What can be detected in a call's content

When a call is transcribed, you get text, and that text can be checked. A few things give away a spam call even in text:

• One side talks. In a recorded message there is no conversation: one voice talks, and the other side stays silent or hangs up.
• A general offer. A deal, a loan or insurance, with no connection at all to whoever answered.
• Survey questions. "If you agree, press 1."
• Sales pressure. "Today only," "only for those who decide now."

A regular call looks different: it has two sides, names, questions and answers, and a matter that concerns both of them. This difference is what allows automatic analysis to tell them apart.

Filtering in the PBX vs. a mobile app

There are apps for mobile phones that detect spam. Many of them rely on reports: users mark a number as spam, and the app warns others.

In an organization, the difference is noticeable. An app has to be installed on every phone, and it does not work on a desk phone. Filtering in the PBX applies to the calls that go through it, from any device. Even a desk phone or a kosher phone, which have no apps, are filtered, as long as the call goes through the PBX.

Detection from call analysis that is already done

There is another source for detection, which already works today: recorded calls that are already analyzed. Kesher's system automatically analyzes recorded calls, and among other things it classifies calls by their content.

When such a call is classified as spam with 90% certainty or more, the service blocks its number permanently for all subscribers. With lower certainty, the number is blocked for an hour, and the decision goes to the service manager. There's no need to wait for the number to cross the dialing threshold. One clear call is enough.

The words "with high certainty" are important here. Only a high-certainty classification blocks a number this way. And as with every other method, every block is recorded in the log.

Manual marking: a customer who marks a number as spam

Sometimes a customer recognizes spam before any system does: they answered, heard an ad, and they know. That is why a customer can also mark a number as spam themselves.

This kind of marking works in two stages:

1. Immediately, for whoever marked it. The number is blocked for the customer who marked it, across their whole system.
2. For everyone, only after a review. The number goes to the service manager for review, and the manager decides whether it is spam. Only if the manager approves is the number blocked for all subscribers.

Why not block it for everyone right away? Because one customer's marking can be a mistake, for example a tap on the wrong number, or the number of someone the customer does not want to hear from, but who is not spam. If every marking blocked the number for everyone, one customer could block a number for everyone, by mistake or on purpose. This way, the decision for everyone always goes through the service manager.

With automatic detection, on the other hand, there is no waiting for approval: a number that crossed the dialing threshold is blocked right away for an hour for all subscribers, and a call classified as spam with 90% certainty or more blocks the number for everyone permanently.

Marking correctly: a few rules for your team

When your team knows when to mark a number as spam, the filtering gets better. A few rules worth setting:

• Mark only spam: advertising, a survey, a recorded message or a sales pitch. A customer who was unpleasant on a call is not spam.
• Check the number before marking it, especially when there were several calls in the same hour.
• The number of someone you do not want to hear from, but who is not spam, belongs on the personal block list, not marked as spam.
• One or two people in charge of marking, just as with the personal block list.

Remember that marking blocks the number immediately for you, across your whole system. If a number is blocked by mistake, the service manager can release it.

Mistakes, release and the log

Any automatic system can make mistakes. That is why the service has two things that make corrections possible:

• Log. Every block is recorded in the log, whichever method caused it.
• Release. The service manager sees all the blocks, can release a number that was blocked by mistake, and can set a number as protected, so it won't be blocked as spam.

The structure itself also reduces mistakes: the fast block based on the dialing pattern is temporary and ends after an hour, a permanent block requires a decision by the service manager or high certainty, and a customer's manual mark doesn't block for everyone without approval. The log and the release are a safety net for the cases that still remain.

Think a number that matters to you was blocked by mistake? Contact us with the number, and the service manager will check.

The power of a network: why shared filtering works better

A customer who filters on their own sees only their own calls. From their point of view, a spam number is one unclear call. The service sees the whole PBX, so it detects what no customer can see alone.

And it works the other way too: a number blocked because of calls to others is blocked for you as well. Everyone who subscribes to the service benefits from everyone's detection, without doing anything.

It is like neighbors on a street telling each other about a salesman going door to door. Each one alone hears only one knock on the door. Together, they see the whole round.

What spam filtering does not stop

It is worth knowing the limits too:

• Slow spam. A number that dials only a little, below the threshold, will not be stopped by the dialing pattern. It can still be stopped by call analysis, or by the personal block list.
• The first calls. By the time a number crosses the threshold, a few calls have already gone out from it. The service stops what comes next, not the start.
• A new number every time. An autodialer that changes its number after a few calls is harder to detect by pattern. Against it, call analysis and a short IVR menu at the start of the call help.
• Calls that do not go through anything you added. The service filters only what you added to it.

That is why spam filtering is one layer out of several. Together with the Rabbinical Committee's list, the personal block list and a short menu at the start of the call, much less room is left for these calls.

An example from the field

On Thursday morning, an unknown number started dialing different customers on the PBX: a store, an accountant's office, a yeshiva and a few more. Within seven minutes it dialed 12 different numbers.

The service detected the pattern, and the number was blocked immediately for an hour for all subscribers. For Avraham, who runs a small office that had joined the service a week earlier, the number never came through at all.

The service manager checked the number: it was a recorded message offering an insurance deal, and the manager decided on a permanent block.

That same week, another number dialed 15 different numbers within ten minutes. It was also blocked for an hour. But when the service manager checked it, it turned out to be a delivery company's call center, calling customers back to schedule deliveries. That's not spam: the number was released, and the service manager set it as protected, so it won't be blocked again.