SPAM-JAMR's threat engine is built as a three-tier pipeline. Each tier has a single responsibility, and data flows forward from raw sources to a final risk verdict. No tier reaches back — information always moves in one direction.
The Data Intelligence Network. Gathers raw intelligence from 8 distinct sources, detects attack scenarios (neighbor spoofing, rotating numbers, robocall farms), and transforms everything into a normalized 47-element FloatArray for the ML engine.
The Machine Learning Engine. Receives the 47-feature array, runs it through a single-layer neural network with trained weights and sigmoid activation, and outputs a risk probability. Learns from every user action — gets smarter with use.
The Decision Layer. Takes the ML prediction and combines it with three other risk factors in a weighted analysis. Then checks for escalation triggers that can bump the risk level up. Produces the final score and verdict.
SCROLL HORIZONTALLY TO VIEW FULL DIAGRAM • PINCH TO ZOOM
Every incoming call is decomposed into 47 distinct numerical features organized across 5 categories. DataiNetX™ extracts these from the raw data sources and normalizes them into a FloatArray — the language AdaptEdgeML™ understands. Each feature is a signal. Alone, any single feature means little. Combined through weighted multiplication, patterns emerge that no single rule could catch.
Before features reach the ML engine, DataiNetX™ runs scenario-level pattern matching to detect coordinated attack patterns that individual features might miss:
ThreatIntelligence doesn't rely on any single signal. It combines four independent risk assessments, each weighted by reliability and predictive value, into a single composite score from 0 to 100.
The weighted sum maps to one of five risk levels, each with a recommended action.
After ThreatIntelligence calculates the base risk score, the Escalation Engine checks for specific behavioral triggers that indicate higher danger than the raw numbers suggest.
| Trigger | Detection | Threshold |
|---|---|---|
| NOT_VERIFIED | STIR/SHAKEN failed or unverified | Always +1 level |
| RAPID_CALLS | Same number calling repeatedly | 2+ in 5 min or 5+ in 30 min |
| ROTATING_NUM | Similar numbers with sequential digits | 2+ matching prefix |
| SEQ_PATTERN | Robocall farm detection | 3+ distinct sequential numbers |
| PREV_BLOCKED | Number was previously blocked | In blocked list |
| OFF_HOURS | Calling outside normal hours | Before 8 AM or after 9 PM |
| HI_RISK_AREA | Known high-spam area code | Area code risk score 70+ |
AdaptEdgeML™ doesn't just follow static rules — it learns from every action you take. When you block a number, report spam, or trust a caller, the engine adjusts its internal weights through gradient descent.
The neural network uses a single-layer perceptron with sigmoid activation. Training uses stochastic gradient descent with a learning rate of 0.01.
| Your Action | Signal | Weight | Why |
|---|---|---|---|
| Block a number | SPAM | 1.5x | Strong spam signal |
| Report spam | SPAM | 2.0x | Strongest — explicit confirmation |
| Quick hang-up | SPAM | 0.8x | Weak — could be accidental |
| Ignore repeated | SPAM | 0.7x | Weak — passive rejection |
| Whitelist | SAFE | 2.0x | Strongest safe — explicit trust |
| Answer (full call) | SAFE | 1.2x | Moderate — user engaged |
| Call back | SAFE | 1.5x | Strong safe — voluntary contact |
Weights persist in local storage and survive app restarts.
All 47 features extracted and all ML predictions run entirely on your device. No cloud servers, no API calls for threat data.
Neural network weights trained and stored exclusively in your phone's local storage.
Release builds strip all personally identifiable information. Phone numbers and contact names never in system logs.
Threat databases downloaded and stored locally. Full call screening works offline after initial setup.
STIR/SHAKEN status comes from your carrier's network — SPAM-JAMR reads it, never sends it.