Systems And Methods For Determining Authenticity Of A Message

FIELD OF INVENTION

[0001] The present subject matter relates to communication networks and, particularly, but not exclusively, to methods and systems for determining authenticity of a message transmitted over a communication network. BACKGROUND

[0002] Computing systems, such as cellular phones, smart phones, personal digital assistants (PDAs), tablets, and laptops provide users with a variety of applications, services, and networking capabilities. Such computing systems have seemingly become a ubiquitous part of today’s lifestyle, and the digital technology has found its way into different aspects of human life, professional as well as personal. Users use their computing systems to communicate with each other regarding various topics using communication services, such as messages, electronic mail (e-mail), social networking portals, chat rooms and blogs.

[0003] In the last few years, the communication services have also become a medium to spread rumours and malicious messages. These messages are spread by a few malicious users who intend to create a false belief in other users by sending such messages. Most users forward the received messages to their contacts resulting in a rapid spread of the rumours and the malicious messages. The negative impact of the rumours and the malicious messages includes psychological, economic, emotional, and even physical implications. In many situations, the rumours and the malicious messages may cause riots, communal attacks, and tensions between communities. In certain cases, rumours and malicious messages have also adversely affected business, such as fall in stock prices. In other cases, rumours and malicious messages have been used to defame famous personalities and organizations. SUMMARY

[0004] This summary is provided to introduce concepts related to determining authenticity of a message transmitted over a communication network. This summary is not intended to identify essential features of the claimed subject matter nor is it intended for use in determining or limiting the scope of the claimed subject matter. 3

[0005] According to an embodiment, a method for determining authenticity of a message transmitted over a communication network is described. The method includes extracting keywords from a first received message and determining a number of similar messages as that of the first received message based on the extracted keywords. The method further comprises generating a request for a rumour probability index for the first received message on determining the number of similar messages exceeding a predefined threshold number and receiving the rumour probability index of the first received message from a service provider. Thereafter a notification is generated to alert a user of a probability of the first received message being a rumour.

[0006] In another embodiment, a computing system for determining authenticity of a message transmitted over a communication network is described. The computing system includes a processor. The computing system further includes a keyword extraction module to extract keywords from the first received message. The computing system also comprises a message scanning module to determine a number of similar messages as that of the first received message based on the extracted keywords. The computing system further includes a certification module to generate a request for a rumour probability index for the first received message on the number of similar messages to exceed a predefined threshold number and receive the same. The certification module also generates a notification to alert a user of a probability of the first received message being a rumour.

[0007] According to another embodiment, a method for determining authenticity of a message transmitted over a communication network is described. The method includes receiving a request to compute a rumour probability index for the first received message. The method also includes receiving keywords associated with the first received message and updating a fraction of requests received for similar messages from a plurality of regions. Thereafter a skewness index is computed based on the updated fraction. The method further includes determining whether the skewness index is less than a predefined threshold index and if so, generating the rumour probability index indicating the first received message to be true on determining the skewness index to be less than the predefined threshold. BRIEF DESCRIPTION OF DRAWINGS

[0008] The detailed description is described with reference to the accompanying figures. In the figures, the left-most digit(s) of a reference number identifies the figure in 4 which the reference number first appears. The same numbers are used throughout the figures to reference like features and components:

[0009] Figure 1 schematically illustrates the components of a computing system, for determining authenticity of a message, in a network environment, according to an example of the present subject matter.

[0010] Figure 2 illustrates a method for determining authenticity of a message transmitted over a communication network, according to an example of the present subject matter.

[0011] Figure 3 illustrates a method for determining authenticity of a message transmitted over a communication network, according to another example of the present subject matter.

[0012] Figure 4 illustrates a method for determining authenticity of a message transmitted over a communication network in a hotspot region, according to an example of the present subject matter.

[0013] Figure 5 illustrates a method for determining authenticity of a message transmitted over a communication network in the hotspot region, according to another example of the present subject matter. DETAILED DESCRIPTION

[0014] The present subject matter relates to systems and methods for determining authenticity of a message transmitted over a communication network. The methods and systems as described herein may be implemented in any computing system capable of transferring data over a communication network. Example of such computing systems may include mobile phones, smart phones, tablets, laptops, personal computers and personal digital assistants (PDAs).

[0015] In recent times, there has been an exponential increase in the number of messages transmitted over communication network using communication services, such as short message services (SMS). Large number of these messages may include rumors and malicious messages. In many cases malicious users spread false and sensational information through messages to cause emotional outbursts and panic amongst the users. For example, rumours reporting attacks on persons based on their color, creed, religion and geographical origin may cause panic amongst such persons.

[0016] In most cases, the user, who receives any message, usually forwards the same to other users known to him which results in quick spreading of the false and 5 sensational information. The users, having no way to verify the authenticity of the message, usually believe the information stated in the message and take actions based on the information. To bring the situation under control during such situations, the regulating authorities have imposed restrictions on the number of messages that may be sent by each user in a day. This has caused inconvenience to users who use messages to communicate or keep in touch.

[0017] Most commercially available systems detect the source of the rumours and the malicious messages after a significant spread of the same has already occurred. Further, the commercially known systems also generate a lot of false positives and false negatives in detecting whether a message is a rumour or not. Thus, the adoption of such systems has been quite low.

[0018] The systems and methods, described herein, determine the authenticity of a message transmitted over a communication network. In one example, a computing system, on receiving a first received message, may extract keywords from the first received message and store the keywords as an index. The computing system may then search for other received messages which are similar to the first received message, by scanning an inbox of the computing system. In one example, the computing system may determine the number of received messages which are similar to the first received message based on the number of common keywords. In case, the number of similar messages is greater than a predefined threshold number, the computing system determines whether the first received message is an advertisement. In one implementation, the computing system may determine the first received message to be an advertisement based on the presence of business specific keywords, such as buy, sell, discount and rent. In case, the number of similar messages is less than a predefined threshold number or the first received message is determined to be an advertisement, any further analysis of the first message is aborted.

[0019] In case the first received message is not an advertisement, the computing system may generate a request to a service provider for determining a rumour probability index of the first received message. The rumour probability index is indicative of the probability of the first received message being a rumour.

[0020] In operation, the service provider determines the number of requests received for verification of the messages similar to the first received message from various regions. In one example, the service provider may determine a skewness index indicative of the asymmetry in the number of requests received from each of the various 6 regions. In case, the skewness index is less than a predefined threshold index, the service provider determines that the information portrayed in the first received message has propagated uniformly across regions irrespective of their geographical location and thus has a probability of being true. Based on the same, the service provider generates the rumour probability index and transmits the same to the computing system.

[0021] In case, the skewness index is greater than a predefined threshold, the service provider initiates a further analysis in the region from where the highest number of requests has been received. The region from where the highest number of requests has been received is also referred to as the hotspot region. The service provider analyzes the number of computing systems which are possible originators of the information portrayed in the first received message. Based on the fraction of the computing systems which are possible originators of messages similar to the first received message, the service provider computes the rumour probability index and transmits the same to the computing system.

[0022] Thus, the computing system for determining authenticity of a message transmitted over a communication network as described above facilitates the user to be informed about the probability of a message being a rumour before forwarding the same to other users. The computing system for determining authenticity of a message transmitted over a communication network thus reduces the spread of malicious messages and rumours.

[0023] The above systems and methods are further described in conjunction with the following figures. It should be noted that the description and figures merely illustrate the principles of the present subject matter. It will thus be appreciated that those skilled in the art will be able to devise various arrangements that, although not explicitly described or shown herein, embody the principles of the present subject matter and are included within its spirit and scope. Furthermore, all examples recited herein are principally intended expressly for pedagogical purposes to aid the reader in understanding the principles of the present subject matter and the concepts contributed by the inventor(s) to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions. Moreover, all statements herein reciting principles, aspects, and examples of the present subject matter, as well as specific examples thereof, are intended to encompass equivalents thereof.

[0024] The manner in which the systems and methods for determining authenticity of a message transmitted over a communication network are implemented 7 shall be explained in details with respect to Figures 1, 2, 3, 4 and 5. While aspects of described systems and methods for determining authenticity of a message transmitted over a communication network can be implemented in any number of different computing systems, environments, and/or configurations, the examples and implementations are described in the context of the following system(s).

[0025] Figure 1 schematically illustrates the components of a computing system 102 for determining authenticity of a message in a network environment 100, according to an example of the present subject matter. In one implementation, the computing system 102 includes a processor 104, and a memory 104 connected to the processor 104. The processor 104 may include microprocessors, microcontrollers, and logic circuitries. Among other capabilities, the processor 104 may fetch and execute computer-readable instructions stored in the memory 104.

[0026] The memory 104, communicatively coupled to the processor 104, can include any non-transitory computer-readable medium known in the art including, volatile memory and non-volatile memory, such as read only memory (ROM), flash memories, hard disks, optical disks, and magnetic tapes.

[0027] Further the computing system 102 includes interfaces 108. The interfaces 108 may include a variety of commercially available interfaces, for example, interfaces for peripheral device(s), such as data input output devices, referred to as I/O devices, storage devices, network device. The I/O device(s) may include wireless interfaces, wireless antennas, Universal Serial Bus (USB) ports, Ethernet ports, host bus adaptors, and their corresponding device drivers.

[0028] Further, the computing system 102 may include modules 110. The modules 110 may be coupled to the processor 104. The modules 110, amongst other things, include routines, programs, objects, components, and data structures, which perform particular tasks or implement particular abstract data types. The modules 110 may also be implemented as logic circuitries and/or any other device or component that manipulate signals based on computer-readable instructions.

[0029] In said implementation, the modules 110 include a message scanning module 112, a keyword extraction module 114, a certification module 116 and other module(s) 118. The other module(s) 118 may include computer-readable instructions that supplement applications or functions performed by the computing system 102. 8

[0030] Further, the computing system 102 may also include data 120. In one implementation, the data 120 includes message data 122 and other data 124. The other data 124 may include data generated and saved by the modules 110 for providing various functionalities of the computing system 102.

[0031] In one example, the computing system 102 is communicatively coupled to a message authentication system 126 over a communication network 128. The communication network 128 may include Global System for Mobile Communication (GSM) network, Universal Mobile Telecommunications System (UMTS) network, Long Term Evolution (LTE) network, Personal Communications Service (PCS) network, Time Division Multiple Access (TDMA) network, Code Division Multiple Access (CDMA) network, Next Generation Network (NGN), Public Switched Telephone Network (PSTN), and Integrated Services Digital Network (ISDN).In one implementation, the message authentication system 126 includes a rumour probability index (RPI) computation module.

[0032] In operation, the message scanning module 112 may initiate determination of authenticity on receiving a first received message or on the user forwarding the first received message or on receiving a user input to determine the authenticity of the first received message. In one example, the keyword extraction module 112 may extract keywords from the first received message based on a predefined dictionary of words and phrases stored as message data 122. The message scanning module 112 may then scan the inbox of the computing system to determine whether there are other messages similar to the first received message. In one implementation, the message scanning module 112 may compute a similarity coefficient for each message, represented by α, indicative of the similarity between the each message and the first received message. In one example, the similarity coefficient may be determined by computing the Pearson Coefficient of each of the messages based on the similarity of keywords present in each of the messages. In case, the similarity coefficient is above a predefined similarity threshold, the message scanning module 112 classifies the messages to be similar. The message scanning module also determines the number of messages, received by the computing system 102, which are similar to the first received message.

[0033] In case, the number of similar messages is greater than a predefined threshold number, the certification module 116 determines whether the first received message is an advertisement. In one example, the certification module 116 may classify 9 the first received message to be an advertisement based on the presence of business specific keywords, such as buy, sell, discount and rent. In case, the number of similar messages is less than a predefined threshold number or the first received message is determined to be an advertisement, the certification module 116 aborts any further analysis.

[0034] In case the first received message is not an advertisement, the certification module 116 may generate a request to the RPI computation module 130 of the message authentication system 126 for determining the rumour probability index of the first received message. The certification module 116 may generate the request on the user forwarding the first received message or composing and sending a new message which is similar to the first received message.

[0035] On receiving the request, the RPI computation module 130 may determine the number of requests received for verification of the messages similar to the first received message from various regions. In one implementation, the RPI computation module 130 may determine the region from which the request has been sent by ascertaining the location of the computing system 102. In said implementation, the RPI computation module 130 of the may ascertain a cell tower to which the computation system 102 is latched onto to determine the location of the computing system 102. In another implementation, the message authentication system 126 may prestore the mapping of each cell tower with a region.

[0036] In one example, the RPI computation module 130 may compute a skewness index indicative of the asymmetry of the number of requests received from each of the various regions. In one implementation, the RPI computation module 130 may determine the fraction of requests received from each region and compute the skewness index based on the determination. In another implementation, the RPI computation module 130 may determine the skewness index based on Bowley’s Quartile formula. The RPI computation module 130 may further rank the regions based on the determined fractions. In case, the RPI computation module 130 determines the skewness index to be less than a predefined threshold index, the RPI computation module 130 determines that the information portrayed in the first received message has propagated uniformly across regions irrespective of their geographical location through various media, such as television, internet and radio, and thus has a probability of being true. Based on the same, the RPI computation module 130 generates the rumour probability index and transmits the same to the computing system 102. 10

[0037] In case, the RPI computation module 130 determines the skewness index to be greater than a predefined threshold, the RPI computation module 130 initiates a further analysis in the region from where the highest number of requests has been received, i.e., the hotspot region. In one example, the RPI computation module 130 generates a request for all computing systems in the hotspot region, such as the computing systems 102-1, 102-2 and 102-3, to determine the fraction of computing systems, in the hotpot region, which are possible originators of the information portrayed in the first received message. Based on the fraction of the computing systems 102, in the hotspot region, which are possible originators of messages similar to the first received message, the RPI computation module 130 of the message authentication system 126 computes the rumour probability index and transmits the same to the certification module 116. The RPI computation module 130 assumes that a true event will be witnessed and reported by many users, whereas a rumour would be initiated by a few users. Thus, a higher fraction of possible originators would result in the RPI computation module 130 determining information in the first received message to be true. On receiving the rumour probability index, the certification module 116 may generate a notification for the user informing him about the probability of the first received message being a rumour.

[0038] Thus, the computing system 102 for determining authenticity of a message transmitted over the communication network 128 as described above facilitates the user to be informed about the probability of a message being a rumour before forwarding the same to other users. The computing system 102 thus reduces the spread of malicious messages and rumours.

[0039] Figure 2 illustrates a method 200 for determining authenticity of a message transmitted over a communication network, according to an example of the present subject matter. Figure 3 illustrates a method 300 for determining authenticity of a message transmitted over a communication network, according to another example of the present subject matter. In one example, the method 300 may be implemented using the RPI computation module 130. Figure 4 illustrates a method 400 for determining authenticity of a message transmitted over a communication network in a hotspot region, according to an example of the present subject matter. Figure 5 illustrates a method 500 for determining authenticity of a message transmitted over a communication network in the hotspot region, according to another example of the present subject matter. 11

[0040] The order in which the methods 200, 300, 400 and 500 are described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order to implement methods 200, 300, 400 and 500, or an alternative method. Additionally, individual blocks may be deleted from the methods 200, 300, 400 and 500 without departing from the spirit and scope of the subject matter described herein. Furthermore, the methods 200, 300, 400 and 500 may be implemented in any suitable hardware, machine readable instructions or combination thereof.

[0041] In one example, the steps of the methods 200, 300, 400 and 500 can be performed by programmed computers. Herein, some examples are also intended to cover program storage devices, for example, digital data storage media, which are machine or computer readable and encode machine-executable or computer-executable programs of instructions, where said instructions perform some or all of the steps of the described methods 200, 300, 400 and 500. The program storage devices may be, for example, digital memories, magnetic storage media such as a magnetic disks and magnetic tapes, hard drives, or optically readable digital data storage media.

[0042] With reference to method 200 as depicted in Figure 2, as illustrated in block 202, keywords are extracted from a first received message. In one implementation, the keyword extraction module 114 may retrieve keywords from the first received message whenever the user wants to forward it or whenever the user provides an input to check the authenticity of the first received message.

[0043] As shown in block 204, received messages are scanned to detect the number of received messages similar to the first received message. In one example, the message scanning module 112 may scan the inbox of the computing system 102 to determine similar messages as that of the first received message.

[0044] At block 206 it is determined whether the number of similar messages is greater than a threshold number. In one example, the message scanning module 112 determines the number of messages whose similarity coefficient is greater than the predefined threshold.

[0045] If at block 206 it is determined that the number of similar messages is less than a threshold number, then, as shown in block 208, any further analysis of the first received message is aborted.

[0046] If at block 206 it is determined that the number of similar messages is greater than a threshold number, then, as illustrated in block 210, it is determined whether the first received message is an advertisement. In one implementation, the 12 certification module 116 may classify the first received message to be an advertisement based on the presence of business specific keywords.

[0047] If at block 210 it is determined that the first received message is an advertisement, then, as shown in block 208, any further analysis of the first received message is aborted.

[0048] If at block 210 it is determined that the first received message is not an advertisement, then, as depicted in block 212, a request is generated to a service provider for determining a rumor probability index of the first received message. In one implementation, the certification module 116 generates a request for the message authentication system 126 to determine the rumor probability index of the first received message.

[0049] As illustrated in block 214, the rumor probability index for the first received message is received. In one implementation, the certification module 116 receives the rumor probability index of the first received message.

[0050] At block 216, a notification is generated for a user indicating the probability of the first received message of being a rumor based on the rumor probability index. In one example, the certification module 116 may generate a notification for alerting the user if the first received message has a high probability of being a rumour.

[0051] With reference to method 300 as depicted in Figure 3, as illustrated in block 302 receive a request to compute a rumour probability index of a first received message.

[0052] As depicted in block 304, keywords extracted from the first received message are received. As shown in figure 306, a correlation index for the first received message with other messages received within a pre-defined time interval is determined.

[0053] At block 308, it is determined whether there is at least one group of messages having a group correlation index within pre-specified range of the determined correlation index.

[0054] If at block 308 it is determined that there is at least one group of messages having a group correlation index within pre-specified range of the determined correlation index, then, as shown in block 310, the group id of the group of messages having the highest group correlation index is assigned to the first received message.

[0055] If at block 308 it is determined that there is no group of messages which has a group correlation index within pre-specified range of the determined correlation 13 index, then, as shown in block 312, a new group id is assigned to the first received message. As illustrated in block 314, the fraction of the requests received for messages similar to the first received message from a plurality of regions is updated.

[0056] As depicted in block 316, the plurality of regions are ranked based on the fraction of requests received from each of the plurality of regions. At block 318, a skewness index, indicative of the degree of asymmetry of the number of the requests received from each of the plurality of region is computed.

[0057] At block 320, it is determined whether the skewness index is less than a predefined threshold. If at block 320, it is determined that the skewness index is less than a predefined threshold, then, as shown in block 322, a rumour probability index, indicating the first received message is true, is generated.

[0058] If at block 320, it is determined that the skewness index is greater than a predefined threshold, then, as shown in block 324, verification of the first received message in the region having the highest rank is initiated. The method for verification of the first received message in the region having the highest rank is described in greater detail in conjunction with figure 4. In one example, the method 300 may be implemented using the RPI computation module 130.

[0059] With reference to method 400 as depicted in Figure 4, as illustrated in block 402, a request, for verification of a message, based on a group id of the message is generated in the hotspot region. In one implementation, the request includes a probe request and a time to live (TTL). In said implementation the TTL may be set to a small integer, such as 3 and 4.

[0060] As depicted in block 404, the request is transmitted to computing systems 102 present in the hotspot region. In one implementation, the computing systems 102 present in the hotspot region may be identified based on the cell tower to which the computing systems 102 are connected.

[0061] At block 406, the number of computing systems to which the request has been transmitted is tracked. As shown in block 408, the number of computing systems, which are possible originators of a similar message as that of the first received message, is determined.

[0062] As illustrated in block 410, the fraction of computing systems which are possible originators is computed. As depicted in block 412, a rumour probability index is determined based on the fraction of possible originators. 14

[0063] With reference to method 500 as depicted in Figure 5, as illustrated in block 502, receive a probe request and a time to live (TTL), for the first received message, by a computing system in the hotspot region.

[0064] As shown in block 504, the group id and keywords associated with the first received message is received.

[0065] As depicted in block 506, the inbox and the outbox of the computing systems 102 are scanned to determine similar messages as that of the first received message.

[0066] At block 508, it is determined whether there is a similar message as that of the first received message. If at block 508, it is determined that there is no similar message as that of the first received message, then as depicted in block 520, the probe request and the TTL are forwarded to another computing system 102 in the hotspot region.

[0067] If at block 508, it is determined that there is a similar message as that of the first received message, then as depicted in block 510, it is determined whether the received time of the similar message less than the sent time of the similar message.

[0068] If at block 510 it is determined that the received time of the similar message is greater than the sent time of the similar message, as depicted in block 512, a message is transmitted to the message authentication system 126 indicating that the computing system 102 is an possible originator of the similar message. Thereafter, as shown in block 514, the value of TTL is decreased by unity.

[0069] If at block 510 it is determined that the received time of the similar message is less than the sent time of the similar message, as depicted in block 514, the value of TTL is decreased by unity.

[0070] At block 516, it is determined whether the value of TTL equal to zero. If the value of the TTL is determined to be zero, as shown in block 518, the operation is aborted. If the value of the TTL is determined not to be zero, as depicted in block 520, the probe request and the TTL are forwarded to another computing system 102 in the hotspot region, whose contact details, such as mobile number, are present in the computing system 102.

[0071] Although implementations for determining authenticity of a message transmitted over a communication network have been described in language specific to structural features and/or methods, it is to be understood that the appended claims are not necessarily limited to the specific features or methods described. Rather, the specific 15 features and methods are disclosed as examples of systems and methods for determining authenticity of a message transmitted over a communication network. 16 I/We claim: 1. A method for determining authenticity of a first received message transmitted over a communication network, the method comprising: extracting keywords from a first received message; determining a number of similar messages as that of the first received message based on the extracted keywords; sending a request to a service provider for determining a rumour probability index for the first received message when the number of similar messages exceed a predefined threshold number; receiving the rumour probability index of the first received message from a service provider; and generating, based on the rumour probability index received from the service provider, a notification for a user to alert the user of a probability of the first received message being a rumour. 2. The method as claimed in claim 1, the method further comprising: determining whether the first received message is an advertisement based on the extracted keywords; aborting the determination of authenticity of the first received message on determining the first received message to be an advertisement. 3. A method for determining authenticity of a first received message transmitted over a communication network, the method comprising: receiving a request to compute a rumour probability index for the first received message; receiving keywords associated with the first received message; updating a fraction of requests received for similar messages from a plurality of regions; computing a skewness index based on the fraction; determining whether the skewness index is less than a predefined threshold; and 17 generating the rumour probability index indicating the first received message to be true on determining the skewness index to be less than the predefined threshold. 4. The method as claimed in claim 3, the method further comprising: ranking each of the plurality of regions based on the fraction; designating the region from amongst the plurality of regions having the highest fraction as a hotspot region; and initiating authentication of the message in the hotspot region. 5. The method as claimed in claim 3, wherein the initiating further comprises: generating a probe request for computing systems (102) in the hotspot region; transmitting the probe requests to the computing systems (102) in the hotspot region; determining the fraction of computing systems (102) which are possible originators of a similar message as that of the first received message; and generating the rumour probability index of the first received message based on the fraction. 6. A computer readable medium comprising machine readable instructions, the computer readable medium being loadable into a computing system and adapted to cause execution of the method according to any of claims 1 through 5 when the computer program is run by the computing system. 7. A computing system (102) for determining authenticity of a first received message transmitted over a communication network, the computing system comprising: a processor (104); a keyword extraction module (114), coupled to the processor (104), to extract keywords from the first received message; a message scanning module (112), coupled to the processor (104), to determine a number of similar messages as that of the first received message based on the extracted keywords; and 18 a certification module (116), coupled to the processor (104), to: generate a request for a rumour probability index for the first received message on the number of similar messages to exceed a predefined threshold number; receive the rumour probability index of the first received message from a service provider; and generate a notification for a user to alert the user of a probability of the first received message being a rumour. 8. The computing system (102), as claimed in claim 7, wherein the certification module (116) further: determines whether the first received message is an advertisement based on the extracted keywords; and aborts the determination of authenticity of the first received message on determining the first received message to be an advertisement. 9. The computing system (102), as claimed in claim 7, wherein the message scanning module (112) further: receives a probe request to determine if the computing system (102) is an possible originator of a similar message as that of the first received message; scans an inbox and an outbox of the computing system (102) to determine the presence of similar messages as that of the first received message; and determines the received time and the sent time of the similar messages. 10. The computing system (102), as claimed in claim 9, wherein the certification module (116) further determines the computing system (102) to be the possible originator of the similar message based on the determined the received time and the sent time of the similar messages.