Abstract:
A service that leverages a flexible, extensible, and dynamically configurable Message Evaluation Framework to provide comprehensive malware detection and optional malware elimination capabilities within established wireless messaging paradigms such as, possibly inter alia, Multimedia Message Service, Wireless Application Protocol, and IP Multimedia Subsystem. The service may optionally leverage the capabilities of a centrally-located Messaging Inter-Carrier Vendor.

Description:
[0001]    This application claims the benefit of U.S. Provisional Patent Application No. 60/876,524, filed on Dec. 22, 2006, which is herein incorporated by reference in its entirety. 
     
    
     BACKGROUND 
       [0002]    1. Field of the Invention 
         [0003]    The present invention relates generally to telecommunications services. More particularly, the present invention relates to capabilities that enhance substantially the value and usefulness of various messaging paradigms including, inter alia, Multimedia Message Service (MMS), Wireless Application Protocol (WAP), Internet Protocol (IP) Multimedia Subsystem (IMS), etc. 
         [0004]    2. Background of the Invention 
         [0005]    As the ‘wireless revolution’ continues to march forward the importance to a Mobile Subscriber (MS), for example a user of a Wireless Device (WD)—such as, inter alia, a mobile telephone, a BlackBerry, etc. that is serviced by a Wireless Carrier (WC)—of their WD grows substantially. One consequence of such a growing importance is the resulting ubiquitous nature of WDs—i.e., MSs carry them at almost all times and use them for an ever-increasing range of activities. 
         [0006]    As MSs employ their WDs for ever more activities their WDs become increasingly more vulnerable to a range of undesirable behaviors. One undesirable behavior may be labeled malware (i.e., malicious software or ‘computer contaminant’) and may be considered to include entities such as, possibly inter alia, viruses, worms, Trojan horses, spyware, etc. 
         [0007]    The transit of malware via Electronic Mail (E-mail) and other mechanisms over the Internet has become notorious. Numerous efforts or initiatives have arisen in response to the growth of Internet-based malware including, inter alia, purely technical efforts (such as, e.g., commercial, freeware, and open source filters) and legal initiatives. 
         [0008]    A confluence of several factors, including: 
         [0009]    1) The rapidly expanding universe of target WDs (e.g., there are now over two billion mobile devices throughout the world). 
         [0010]    2) The utilization of WDs (as described above) for increasingly more valuable purposes (such as, inter alia, ‘mobile wallet’ and payment vehicles). 
         [0011]    3) The evolving sophistication of malware artists. 
         [0012]    has led, perhaps inevitably, to malware artists targeting WDs within wireless messaging ecosystems. 
         [0013]    The first instance of mobile malware, the Cabir virus, was detected in mid-2004. By late-2006 over 300 different instances of mobile malware had been identified and cataloged with the rate of increase (of the discovery of new instances of malware) itself rising rapidly. (See, for example, the article “Malware Goes Mobile” in the November 2006 edition of  Scientific American .) 
         [0014]    As a result, a range of new, enhanced anti-malware mechanisms are necessary to identify or detect, and optionally eliminate, malware within a wireless messaging ecosystem. 
         [0015]    The present invention provides such enhanced malware detection and elimination capabilities and addresses various of the (not insubstantial) challenges that are associated with same. 
       SUMMARY OF THE INVENTION 
       [0016]    Embodiments of the present invention employ a flexible, extensible, and dynamically configurable Message Evaluation Framework (MEF) to provide comprehensive malware detection and optional malware elimination capabilities within established wireless messaging paradigms such as, possibly inter alia, MMS, IMS, etc. 
         [0017]    More particularly, embodiments of the present invention provide a method for detecting malware within messages that are transiting a wireless network. The method includes intercepting, at a Messaging Inter-Carrier Vendor (MICV), a message that was sent over a wireless network. The message is passed to an application server that is in communication with a database. The application server then calculates a probability that the message contains malware. Preferably, the probability calculation takes into account, among other things, aspects of the content of the message. 
         [0018]    In accordance with embodiments of the present invention a Sensitivity Factor (SF)—which may be based on one or more of a source address of the message, a source carrier of the message, a frequency count, and/or a time of day or day of week that the message was sent—may be included in a probability calculation. 
         [0019]    If a given message is determined to contain malware then the message may be dropped, cleansed (optionally using Phantom Content), or quarantined. Additionally one or more alert messages may be generated and sent. 
         [0020]    If Phantom Content is used to replace the malware in the message, the message may again be passed to the application server for a re-calculation of the probability the message with the now-excised malware content contains malware. 
         [0021]    These and other features of the embodiments of the present invention, along with their attendant advantages, will be more fully appreciated upon a reading of the following detailed description in conjunction with the associated drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]      FIG. 1  is a diagrammatic presentation of an exemplary MICV. 
           [0023]      FIG. 2  illustrates one particular arrangement that is possible through aspects of the present invention. 
           [0024]      FIG. 3  illustrates an exemplary sliding window facility that may be employed by aspects of the present invention. 
           [0025]      FIG. 4  illustrates an exemplary MEF. 
           [0026]      FIG. 5  illustrates various of the exchanges or interactions that are supported by aspects of the present invention. 
           [0027]      FIG. 6  is a diagrammatic presentation of aspects of an exemplary Service Provider (SP) Application Server (AS). 
       
    
    
       [0028]    It should be understood that these figures depict embodiments of the invention. Variations of these embodiments will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. 
       DETAILED DESCRIPTION 
       [0029]    The present invention may leverage the capabilities of a centrally-located, full-featured MICV facility. Reference is made to U.S. Pat. No. 7,154,901 entitled “INTERMEDIARY NETWORK SYSTEM AND METHOD FOR FACILITATING MESSAGE EXCHANGE BETWEEN WIRELESS NETWORKS,” and its associated continuations, for a description of a MICV, a summary of various of the services/functions/etc. that are performed by a MICV, and a discussion of the numerous advantages that arise from same. The disclosure of U.S. Pat. No. 7,154,901, along with its associated continuations, is incorporated herein by reference. 
         [0030]    As illustrated in  FIG. 1  and reference numeral  100  a MICV  120  is disposed between, possibly inter alia, multiple WCs (WC 1    114 →WC x    118 ) on one side and multiple SPs (SP 1    122 →SP y    124 ) on the other side and thus ‘bridges’ all of the connected entities. A MICV  120  thus, as one simple example, may offer various routing, formatting, delivery, value-add, etc. capabilities that provide, possibly inter alia: 
         [0031]    1) A WC  114 → 118  (and, by extension, all of the MSs  102 → 104 ,  106 → 108 , and  110 → 112  that are serviced by the WC  114 → 118 ) with ubiquitous access to a broad universe of SPs  122 → 124  and 
         [0032]    2) A SP  122 → 124  with ubiquitous access to a broad universe of WCs  114 → 118  (and, by extension, all of the MSs  102 → 104 ,  106 → 108 , and  110 → 112  that are serviced by the WC  114 → 118 ). 
         [0033]    Generally speaking a MICV may have varying degrees of visibility (e.g., access, etc.) to the (MS← →MS, MS← →SP, etc.) messaging traffic: 
         [0034]    1) A WC may elect to route just their out-of-network messaging traffic to a MICV. Under this approach the MICV would have visibility (e.g., access, etc.) to just the portion of the WC&#39;s messaging traffic that was directed to the MICV by the WC. 
         [0035]    2) A WC may elect to route all of their messaging traffic to a MICV. The MICV may, possibly among other things, subsequently return to the WC that portion of the messaging traffic that belongs to (i.e., that is destined for a MS of) the WC. Under this approach the MICV would have visibility (e.g., access, etc.) to all of the WC&#39;s messaging traffic. 
         [0036]    An implementation that contains a ‘route all of their messaging traffic to a MICV’ option may serve to enhance aspects of the present invention. 
         [0037]    While the discussion below will include a MICV it will be readily apparent to one of ordinary skill in the relevant art that other arrangements are equally applicable and indeed are fully within the scope of the present invention. 
         [0038]    In the discussion below the present invention is described and illustrated as being offered by a SP. A SP may, for example, be realized as a third-party service bureau, an element of a WC or a landline carrier, an element of a MICV, multiple third-party entities working together, etc. 
         [0039]    To help explain key aspects of the present invention consider the illustrative example that is depicted through  FIG. 2  and the narrative below. 
         [0040]    As indicated in  FIG. 2  and reference numeral  200  all of the messaging traffic of numerous WCs (WC 1    210 →WC n    212 ) is exchanged with a MICV  214  and the MICV  214  is connected with SP x    216  (a SP that offers, possibly inter alia, the present invention). Among other things this provides SP x    216  with visibility (access, etc.) to all of the messaging traffic (to, possibly inter alia, conduct malware detection operations against all of that traffic) and, inter alia, the opportunity (as explained below) to continuously expand its internal repositories, refine the results of its message review and other analytical activities, etc. as time progresses (and as ever more messages are presented to it). 
         [0041]    Aspects of the present invention include a flexible, extensible, and dynamically configurable MEF. As explained below, a MEF (possibly inter alia) may accept as input an incoming (MMS, etc.) message, apply to the accepted message various rules/logic/data/etc., and generate as output a Malware Probability (MP) (i.e., a probability that the message may be infected with one or more instances of malware). 
         [0042]    It will be readily apparent to one of ordinary skill in the art that a calculated MP may take a number of different forms. For example, possibly inter alia: 
         [0043]    1) A MP may be defined as a scalar value that lies within the range 0&lt;=MP&lt;=1 (with the boundary values of 0 and 1 indicating the absolute or authoritative conditions ‘malware not detected’ [for 0] and ‘malware detected’ [for 1]). 
         [0044]    2) A MP may be defined as a vector, matrix, etc. where each element of same is, possibly inter alia, allowed to span a wider range of values (with, possibly inter alia, an associated modulus or other scaling mechanism to ensure that a final or end calculated value never exceeds a configurable range such as, inter alia, 0%→100%) for cases where, possibly inter alia, multiple instances of malware are detected in a single message; it is desirable to preserve multiple attributes (such as, for example, type, location, etc.) for each instance of malware detection in a message; etc. 
         [0045]    A MEF may contain, possibly inter alia: 
         [0046]    1) A suite of dynamically updateable Mobile Malware Signature Files (MMSFs). A MMSF may contain, possibly inter alia, lineage or ancestry information (including, possibly among other things, creator identification, creation date and time, version number, etc.); a variable-sized binary pattern that is indicative of a mobile virus, worm, Trojan horse, piece of spyware; verification information (such as, possibly among other things, a checksum value); etc. 
         [0047]    A particular piece of malware may be indicated by, or codified through, one or more MMSFs. 
         [0048]    A single MMSF may indicate or codify one or more pieces of malware. 
         [0049]    MMSFs may, possibly inter alia, be created or defined internally by SP x  (for example, in response to the appearance of new malware during SP x &#39;s processing of messages); be culled from publicly available freeware, shareware, etc. sources; be licensed from commercial, open source, etc. parties (such as, among others, McAfee and Symantec); etc. 
         [0050]    A MMSF may be defined as being unique to one specific messaging paradigm (e.g., MMS, IMS, etc.), being applicable to a specific set of messaging paradigms (e.g., as one possible example, MMS and WAP), or being applicable to all of the different messaging paradigms that are supported by SPX. 
         [0051]    The MMSF characteristics that were described above are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other options are easily possible and indeed are fully within the scope of the present invention. 
         [0052]    2) An optional MMSF normalization facility to equalize or otherwise normalize the content, format, structure, etc. of disparate MMSFs. Such a facility may provide the MEF with, possibly inter alia, operational efficiencies through the use of just one internal, proprietary or open, malware signature format, structure, etc. 
         [0053]    3) A SF to indicate the relative importance, likelihood of infection, etc. for a (MMS, etc.) message based on ‘extra’ criteria. For example, a SF may consist of a defined group of, and therefore be calculated or generated by evaluating, one or more of the elements within a flexible, extensible, and dynamically updateable or configurable suite of elements. Potential SF elements might include, possibly inter alia: 
         [0054]    i) Source Address (SA). For example one specific message SA (such as, for example, the source Telephone Number [TN], source Short Code [SC] or Common Short Code [CSC], etc.). Or a mix or collection of specific SAs. Or an explicit range of SAs. 
         [0055]    ii) Frequency Count. For example, the number or count of incoming messages (in total, for a specific SA, for an explicit range of SAs, etc.) within a sliding window. A sliding window  308  may be dynamically configurable to be a specific size or duration. An illustrative sliding window facility is depicted in  FIG. 3  and reference numeral  300 , wherein only certain ones of multiple messages  310 - 338  are analyzed between a start time Ta  304  and an end time Tb  306  over a timeline  302 . 
         [0056]    iii) Time of Day (ToD). For example, the 23 hours of a day—0, 1, 2, . . . , 23, and 24—based on any of several possible reference points (including, possibly inter alia, a local time zone, Greenwich Mean Time, etc.). 
         [0057]    iv) Day of Week (DoW). For example, the seven days of a week—Sunday, Monday, . . . , Friday, and Saturday. 
         [0058]    v) Source Carrier. For example, one specific source carrier (such as, for example, Verizon Wireless, T-Mobile, etc.). Or a mix or collection of specific source carriers. 
         [0059]    The specific SF elements that were described above are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other factors are easily possible and indeed are fully within the scope of the present invention. 
         [0060]    One or more SF elements may optionally be assigned a Weighting Factor (WF) to incrementally increase or decrease the importance or impact of an element to that element&#39;s relative contribution to a SF. As one possible example, a WF may be defined to lie within the range 0&lt;=WF&lt;=1 (with the boundary values of 0 and 1 indicating ‘no weight’ [for 0] and ‘neutral weight’ [for 1]). As another possible example, a WF may be allowed to span a wider range of values (with, possibly inter alia, an associated modulus or other scaling mechanism to ensure that a final or end calculated value never exceeds a configurable threshold such as 100%). 
         [0061]    A SF may optionally default to ‘no impact or effect.’ 
         [0062]    Multiple SFs may be defined with, possibly inter alia, specific SFs being automatically or manually enabled or disabled based on one or more criteria including, for example, ToD, DoW, etc. 
         [0063]    Multiple SFs may, for example for purposes of management and administration, be aggregated into one or more SF Groups (SFGs). 
         [0064]    The SF characteristics that were described above are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other options are easily possible and indeed are fully within the scope of the present invention. 
         [0065]    A graphical depiction of a hypothetical MEF may be found in  FIG. 4  and reference numeral  400 , which illustrates schematically (a) the acceptance of an incoming message  404  as input, (b) the controlled application of, possibly inter alia, one or more MMSFs and/or one or more SFs  406 , and (c) the generation of a MP  408  as output. 
         [0066]    The elements of the MEF that were described above are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other options are easily possible (e.g., any or all of the MMSFs, calculations, values [such as SFs], etc. that were described above might optionally be made WC-specific, MICV-specific, etc.) and indeed are fully within the scope of the present invention. 
         [0067]    To help explain key aspects of the present invention consider the illustrative interactions that are depicted in  FIG. 5  and reference numeral  500  (which capture various of the exchanges or interactions that might occur as [MMS, etc.] messaging traffic is generated, routed, processed, etc.) Of interest and note in the diagram are the following entities: 
         [0068]    MS 1    502 →MS a    504  and MS 1    506 →MS z    508 . MS WDs such as a mobile telephones, BlackBerrys, PalmPilots, etc. 
         [0069]    WC 1    510 →WC n    512 . Numerous WCs. 
         [0070]    MICV  514 . As noted above the use of a MICV, although not required, provides significant advantages. 
         [0071]    SP  516  AS  518 . Facilities that provide key elements of the instant invention (which will be described below). 
         [0072]    SP  516  Database (DB)  520 . One or more data repositories that are leveraged by a AS  518  of SP  516 . 
         [0073]    In the discussion to follow reference is made to messages that are sent, for example, between a MS  502 → 504 / 506 → 508  and an SP  516 . As set forth below, a given “message” sent between a MS  502 → 504 / 506 → 508  and a SP  516  may actually comprise a series of steps in which the message is received, forwarded and routed between different entities, including a WD associated with a MS  502 → 504 / 506 → 508 , a WC  510 → 512 , a MICV  514 , and a SP  516 . Thus, unless otherwise indicated, it will be understood that reference to a particular message generally includes that particular message as conveyed at any stage between an origination source, such as a WD of a MS  502 → 504 / 506 → 508 , and an end receiver, such as a SP  516 . As such, reference to a particular message generally includes a series of related communications between, for example, a MS  502 → 504 / 506 → 508  and a WC  510 → 512 , the WC  510 → 512  and a MICV  514 , and the MICV  514  and a SP  516 . The series of related communications may, in general, contain substantially the same information, or information may be added or subtracted in different communications that nevertheless may be generally referred to as a same message. To aid in clarity, a particular message, whether undergoing changes or not, is referred to by different reference numbers at different stages between a source and an endpoint of the message. 
         [0074]    In  FIG. 5  the exchanges that are collected under the designation Set  1  and Set  2  represent the activities that might take place as (MMS, etc.) messages are routed by the various WCs to a MICV (via  522 → 524 ) and then directed, by the MICV, to SP x    516  (via  526 ). It is important to note these exchanges are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other exchanges are easily possible and indeed are fully within the scope of the present invention. 
         [0075]    In  FIG. 5  the exchanges that are collected under the designation Set  3 , Set  4 , and Set  5  represent the activities that might take place as (MMS, etc.) messages are processed by SP x    516  (specifically by an AS  518  of SP x    516 ). To provide context for our review of the Set  3 , Set  4 , and Set  5  exchanges we take a brief detour to describe an illustrative SP AS. 
         [0076]      FIG. 6  and reference numeral  600  provide a diagrammatic presentation of aspects of an exemplary SP AS  602 . The illustrated AS  602  contains several key components—Gateways (GW 1    608 →GW a    610  in the diagram), Incoming Queues (IQ 1    612 →IQ b    614  in the diagram), WorkFlows (WorkFlow 1    618 →WorkFlow d    620  in the diagram), Database  622 , Outgoing Queues (OQ 1    624 →OQ c    626  in the diagram), and an Administrator  628 . It will be readily apparent to one of ordinary skill in the relevant art that numerous other components are possible within an AS  602 . 
         [0077]    A dynamically updateable set of one or more Gateways (GW 1    608 →GW a    610  in the diagram) handle incoming (MMS/IMS/etc. messaging, etc.) traffic  604 → 606  and outgoing (Short Message Service (SMS)/MMS/IMS/etc. messaging, etc.) traffic  604 → 606 . Incoming traffic  604 → 606  is accepted and deposited on an intermediate or temporary Incoming Queue (IQ 1    612 →IQ b    614  in the diagram) for subsequent processing. Processed artifacts are removed from an intermediate or temporary Outgoing Queue (OQ 1    624 →OQ c    626  in the diagram) and then dispatched  604 → 606 . 
         [0078]    A dynamically updateable set of one or more Incoming Queues (IQ 1    612 →IQ b    614  in the diagram) and a dynamically updateable set of one or more Outgoing Queues (OQ 1    624 →OQ c    626  in the diagram) operate as intermediate or temporary buffers for incoming and outgoing traffic  604 → 606 . 
         [0079]    A dynamically updateable set of one or more WorkFlows (WorkFlow 1    618 →WorkFlow d    620  in the diagram) remove incoming traffic  604 → 606  from an intermediate or temporary Incoming Queue (IQ 1    612 →IQ b    614  in the diagram), perform all of the required processing operations (explained below), and deposit processed artifacts on an intermediate or temporary Outgoing Queue (OQ 1    624 →OQ c    626  in the diagram). The WorkFlow component will be described more fully below. 
         [0080]    The Database  622  that is depicted in  FIG. 6  is a logical representation of the possibly multiple physical repositories that may be implemented to support, inter alia, configuration, word catalog, calculation, etc. information. The physical repositories may be implemented through any combination of conventional Relational Database Management Systems (RDBMSs) such as Oracle, through Object Database Management Systems (ODBMSs), through in-memory Database Management Systems (DBMSs), or through any other equivalent facilities. 
         [0081]    An Administrator  628  provides management or administrative control over all of the different components of an AS  602  through, as one example, a World Wide Web (WWW)-based interface  630 . It will be readily apparent to one of ordinary skill in the relevant art that numerous other interfaces (e.g., an Application Programming Interface [API], a data feed, etc.) are easily possible. 
         [0082]    Through flexible, extensible, and dynamically updatable configuration information a WorkFlow component may be quickly and easily realized to support any number of activities. For example, WorkFlows might be configured to support the receipt and processing of incoming (MMS, IMS, etc.) messages; to support the scanning of the body or content of a received message (using, for example, the MEF that was described previously); to support the generation and dispatch of outgoing alert, update, etc. messages; to support the generation of scheduled and/or on-demand reports; etc. The specific WorkFlows that were just described are exemplary only; it will be readily apparent to one of ordinary skill in the relevant art that numerous other WorkFlow arrangements, alternatives, etc. are easily possible. 
         [0083]    A SP may maintain a repository (e.g., a database) into which selected details of all administrative, messaging, processing, etc. activities may be recorded. Among other things, such a repository may be used to support: 
         [0084]    1) Scheduled (e.g., daily, weekly, etc.) and/or on-demand reporting with report results delivered through SMS, MMS, IMS, etc. messages; through E-mail; through a WWW-based facility; through Instant Messaging (IM); through an Interactive Voice Response (IVR) facility; etc. 
         [0085]    2) Scheduled and/or on-demand data mining initiatives (possibly leveraging or otherwise incorporating one or more external data sources) with the results of same presented through visualization, Geographic Information System (GIS), etc. facilities and delivered through SMS, MMS, IMS, etc. messages; through E-mail; through a WWW-based facility; trough IM; through an IVR facility; etc. 
         [0086]    Generated reports may include, possibly inter alia, a summary of infected messages (e.g., by ToD, by DoW, by day, by week, by month, etc.) for any number of constraints (e.g., malware types, source addresses, etc.), a list of the specific source address(es) that contained infected messages, historical summaries, trend analysis, the results of data mining operations, etc. Generated reports may contain, possibly inter alia, textual and graphic elements. 
         [0087]    Over time as ever more messages are presented to a SP the SP may continuously expand the depth and/or the breadth of its internal repositories, and consequently incrementally refine, improve, etc. the quality, etc. of its message review and other analytical activities including generation of ever more malware detection probabilities. 
         [0088]    Returning to  FIG. 5  . . . the processing activities that are depicted under the designation Set  3 , Set  4 , and Set  5  might include, possibly inter alia (via, among other things,  528 → 530 ): 
         [0089]    A) Retrieving an incoming message from an IQ. 
         [0090]    B) Extracting from a received message, and optionally validating/etc., various data elements including, inter alia, the SA (such as, for example, the source TN), the Destination Address (such as, for example, the destination TN), the message content or body, etc. 
         [0091]    C) Preserving various elements of the received message in a Messages database table. 
         [0092]    D) Updating a MS database table, as appropriate and as required, to ensure that an entry exists for the SA (such as, for example, the TN) of the message. 
         [0093]    E) Performing one or more analytical steps. The analytical steps may be realized through a combination of: 
         [0094]    i) Flexible, extensible, and dynamically configurable Workflows (as previously described) that implement the rules, logic, etc. for a range of methods (including, inter alia, statistical, pattern matching, stylistic, linguistic, heuristic, etc.) that implement the MEF as described above. 
         [0095]    ii) Dynamically updateable data sources (including, possibly inter alia, the MMSFs that were described above). 
         [0096]    and may, possibly among other things, optionally score, rate, rank, etc. the developed results; optionally augment the developed results with internal and/or external demographic, geographic, etc. data; etc. 
         [0097]    F) Generating one or more indicators. Indicators may capture, inter alia, specific characteristics (e.g., based on a MEF-generated MP a finding that a specific message contains one or more instances of malware), patterns, traits, features, etc. 
         [0098]    G) Preserving one or more of the generated indicators in an Indicators database table. 
         [0099]    H) Leveraging a flexible, extensible, and dynamically configurable list of defined events (e.g, as maintained in an EventDefinitions database table) to generate one or more events. Events may include, inter alia, alerting one or more parties (such as, for example, a WC, a MICV, etc.) to the presence of an infected message through any combination of one or more channels such as SMS/MMS/etc. messages, E-mail messages, IM messages, data feeds; optionally blocking an infected message; optionally dynamically updating one or more (SA, etc.) entries in a MEF SF; etc. 
         [0100]    I) Depositing one or more of the generated events on an OQ. 
         [0101]    J) Preserving one or more of the generated events in an Events database table. 
         [0102]    K) Depositing, consistent with the generated indicator(s) and event(s), the incoming message on an OQ (for dispatch, e.g., first back to a MICV and then back to the appropriate WC for final delivery to the appropriate WD). For example, if an incoming message is not identified as containing malware then it may be deposited on an OQ. Alternatively, if an incoming message is identified being infected it may, depending upon previously-identified MICV and/or WC preferences, be blocked or dropped (and hence not deposited on an OQ). 
         [0103]    The catalog of processing steps that were described above are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other processing steps (such as, possibly inter alia, scoring, ranking, rating, etc. one or more of the generated indicators) are easily possible and indeed are fully within the scope of the present invention. For example: 
         [0104]    1) An incoming message that is identified as containing malware may optionally be ‘quarantined’ for, possibly inter alia, subsequent review (by representatives of a MICV, a WC, etc.). 
         [0105]    2) An incoming message that is identified as containing malware may optionally be ‘cleansed.’Cleansing may consist of, possibly inter alia, one or more of such illustrative actions as (a) removing from the message an entire piece of content (e.g., executable code, multimedia, etc.) where the piece of content is identified as being infected with one or more instances of malware, (b) excising from a piece of content (e.g., executable code, multimedia, etc.) each of the identified instances of malware, (c) replacing in the message an entire piece of content (e.g., executable code, multimedia, etc.) with a piece of Phantom Content where the original content is identified as being infected with one or more instances of malware, (c) etc. A cleansed message may optionally be re-processed to ensure that the cleansed message is not infected. 
         [0106]    3) An incoming message that is identified as containing malware may optionally result in one or more outgoing (SMS, MMS, etc.) alert, notification, etc. messages (to, for example, one or more representatives of a MICV, a WC, etc.). 
         [0107]    4) An incoming message that is identified as containing malware may optionally result in one or more alternative lower-level (e.g., protocol, etc.) actions. For example, in the case of an infected MMS message a tailored MM4 negative acknowledgement message (such as ‘Malware Detected’) may be generated (from, for example, a body of dynamically configurable definitional information) and dispatched from either of MICV  514  or AS  518 . For example, in the case of an infected MMS message one or more headers may be created (from, for example, a body of dynamically configurable definitional information) and included in an outgoing Simple Mail Transfer Protocol (SMTP) message. 
         [0108]    5) Various of the elements that were described above might optionally be made WC-specific, MICV-specific, etc. 
         [0109]    6) An optional registration process may be provided (through, possibly inter alia, a WWW site, an exchange of SMS/MMS/etc. messages, an IVR facility, an exchange of E-mail messages, etc.) by which, possibly inter alia, one or more representatives of a MICV, a WC, etc. may identify themselves, provide contact information, etc. 
         [0110]    A SP may optionally offer one or more of the processing steps, reporting capabilities, etc. that were described above as value-add services for which, possibly inter alia, a SP may charge a fee. In support of same a SP may offer a range of billing mechanisms that may involve, possibly inter alia, different external entities (e.g., a WC&#39;s billing system, a carrier billing system service bureau, a credit or debit card clearinghouse, etc.) and/or internal entities. For example, if a SP elects to leverage a WC&#39;s billing system then the exemplary mechanics and logistics that are described in pending U.S. patent application Ser. No. 10/837,695 entitled “SYSTEM AND METHOD FOR BILLING AUGMENTATION” may, possibly among other things, be applied. 
         [0111]    It is important to note the exchanges that were described above (as residing under the designation Set  3 , Set  4 , and Set  5  in  FIG. 5 ) are illustrative only and it will be readily apparent to one of ordinary skill in the relevant art that numerous other exchanges are easily possible and indeed are fully within the scope of the present invention. 
         [0112]    It will be readily apparent to one of ordinary skill in the relevant art that numerous alternatives to the different arrangements that were described above are easily possible. 
         [0113]    The various alert, notification, report, etc. message(s) and/or Phantom Content that was described above may optionally contain an informational element—e.g., a service announcement, a relevant or applicable factoid, etc. that may be unrelated to the original (perhaps now-excised) content. The informational element may be selected statically (e.g., all generated messages are injected with the same informational text), selected randomly (e.g., a generated message is injected with informational text that is randomly selected from a pool of available informational text), or location-based (i.e., a generated message is injected with informational text that is selected from a pool of available informational text based on the current physical location of the recipient of the message as derived from, as one example, a Location-Based Service (LBS)/Global Positioning System (GPS) facility). 
         [0114]    A SP may optionally allow advertisers to register and/or provide (e.g., directly, or through links/references to external sources) advertising content. 
         [0115]    The provided advertising content may optionally be included in various of the message(s) and/or Phantom Content that was described above—e.g., textual material, multimedia (images of brand logos, sound, video snippets, etc.) material, etc. The advertising material may be selected statically (e.g., all generated messages are injected with the same advertising material), selected randomly (e.g., a generated message is injected with advertising material that is randomly selected from a pool of available material), or location-based (i.e., a generated message is injected with advertising material that is selected from a pool of available material based on the current physical location of the recipient of the message as derived from, as one example, a LBS/GPS facility). 
         [0116]    The message(s) and/or Phantom Content that was described above may optionally contain promotional materials, coupons, etc. (via, possibly inter alia, text, still images, video clips, etc.). 
         [0117]    It is important to note that while aspects of the discussion that was presented above focused on the use of TNs, it will be readily apparent to one of ordinary skill in the relevant art that other message address identifiers are equally applicable and, indeed, are fully within the scope of the present invention. 
         [0118]    The discussion that was just presented referenced the specific wireless messaging paradigm MMS. However, it is to be understood that it would be readily apparent to one of ordinary skill in the relevant art that other messaging paradigms (IMS, WAP, E-mail, etc.) are fully within the scope of the present invention. 
         [0119]    It is important to note that the hypothetical example that was presented above, which was described in the narrative and which was illustrated in the accompanying figures, is exemplary only. It is not intended to be exhaustive or to limit the invention to the specific forms disclosed. It will be readily apparent to one of ordinary skill in the relevant art that numerous alternatives to the presented example are easily possible and, indeed, are fully within the scope of the present invention. 
         [0120]    The following list defines acronyms as used in this disclosure. 
         [0000]    
       
         
               
               
               
             
           
               
                   
                   
               
               
                   
                 Acronym 
                 Meaning 
               
               
                   
                   
               
             
             
               
                   
                 API 
                 Application Programming Interface 
               
               
                   
                 AS 
                 Application Server 
               
               
                   
                 CSC 
                 Common Short Code 
               
               
                   
                 DB 
                 Database 
               
               
                   
                 DBMS 
                 Database Management System 
               
               
                   
                 DoW 
                 Day of Week 
               
               
                   
                 E-mail 
                 Electronic Mail 
               
               
                   
                 GIS 
                 Geographic Information System 
               
               
                   
                 GPS 
                 Global Positioning System 
               
               
                   
                 GW 
                 Gateway 
               
               
                   
                 IM 
                 Instant Messaging 
               
               
                   
                 IMS 
                 IP Multimedia Subsystem 
               
               
                   
                 IP 
                 Internet Protocol 
               
               
                   
                 IQ 
                 Incoming Queue 
               
               
                   
                 IVR 
                 Interactive Voice Response 
               
               
                   
                 LBS 
                 Location Based Services 
               
               
                   
                 MEF 
                 Message Evaluation Framework 
               
               
                   
                 MICV 
                 Messaging Inter-Carrier Vendor 
               
               
                   
                 MMS 
                 Multimedia Message Service 
               
               
                   
                 MMSF 
                 Mobile Malware Signature File 
               
               
                   
                 MP 
                 Malware Probability 
               
               
                   
                 MS 
                 Mobile Subscriber 
               
               
                   
                 ODBMS 
                 Object Database Management System 
               
               
                   
                 OQ 
                 Outgoing Queue 
               
               
                   
                 RDBMS 
                 Relational Database Management System 
               
               
                   
                 SA 
                 Source Address 
               
               
                   
                 SC 
                 Short Code 
               
               
                   
                 SF 
                 Sensitivity Factor 
               
               
                   
                 SFG 
                 Sensitivity Factor Group 
               
               
                   
                 SMS 
                 Short Message Service 
               
               
                   
                 SMTP 
                 Simple Mail Transfer Protocol 
               
               
                   
                 SP 
                 Service Provider 
               
               
                   
                 TN 
                 Telephone Number 
               
               
                   
                 ToD 
                 Time of Day 
               
               
                   
                 WAP 
                 Wireless Application Protocol 
               
               
                   
                 WC 
                 Wireless Carrier 
               
               
                   
                 WD 
                 Wireless Device 
               
               
                   
                 WF 
                 Weighting Factor 
               
               
                   
                 WWW 
                 World-Wide Web