SPAM-JAMR's threat engine is built as a three-tier pipeline. Each tier has a single responsibility, and data flows forward from raw sources to a final risk verdict. No tier reaches back — information always moves in one direction.
The Data Intelligence Network. Gathers raw intelligence from 8 distinct sources, detects attack scenarios (neighbor spoofing, rotating numbers, robocall farms), and transforms everything into a normalized 47-element FloatArray for the ML engine.
The Machine Learning Engine. Receives the 47-feature array, runs it through a compact, interpretable on-device model, and outputs a risk probability. Learns from every user action — gets smarter with use.
The Decision Layer. Takes the ML prediction and combines it with three other risk factors in a weighted analysis. Then checks for escalation triggers that can bump the risk level up. Produces the final score and verdict.
SCROLL HORIZONTALLY TO VIEW FULL DIAGRAM • PINCH TO ZOOM
Every incoming call is decomposed into 47 distinct numerical features organized across 5 categories. DataiNetX™ extracts these from the raw data sources and normalizes them into a FloatArray — the language AdaptEdgeML™ understands. Each feature is a signal. Alone, any single feature means little. Combined through weighted multiplication, patterns emerge that no single rule could catch.
Proprietary signal set. What each of the 47 features measures, how it is computed, and how the signals are weighted is proprietary to CYBERINE Labs and is not published.
Before features reach the ML engine, DataiNetX™ runs scenario-level pattern matching to detect coordinated attack patterns that individual features might miss:
ThreatIntelligence doesn't rely on any single signal. It combines four independent risk assessments, each weighted by reliability and predictive value, into a single composite score from 0 to 100.
The weighted sum maps to one of five risk levels, each with a recommended action.
After ThreatIntelligence calculates the base risk score, the Escalation Engine checks for specific behavioral triggers that indicate higher danger than the raw numbers suggest.
| Trigger | Detection | Threshold |
|---|---|---|
| NOT_VERIFIED | STIR/SHAKEN failed or unverified | Always +1 level |
| RAPID_CALLS | Same number calling repeatedly | 2+ in 5 min or 5+ in 30 min |
| ROTATING_NUM | Similar numbers with sequential digits | 2+ matching prefix |
| SEQ_PATTERN | Robocall farm detection | 3+ distinct sequential numbers |
| PREV_BLOCKED | Number was previously blocked | In blocked list |
| OFF_HOURS | Calling outside normal hours | Before 8 AM or after 9 PM |
| HI_RISK_AREA | Known high-spam area code | Area code risk score 70+ |
AdaptEdgeML™ doesn't just follow static rules — it learns from every action you take. When you block a number, report spam, or trust a caller, the engine adjusts its internal weights — entirely on your device, with nothing uploaded.
AdaptEdgeML™ is a deliberately compact, interpretable model — a design choice, not a limitation. It scores a call in microseconds while your phone is still ringing, at negligible battery cost, and every verdict can be traced back to the exact signals that drove it. A call-screening verdict you can't explain is a verdict you can't trust.
The detection power lives upstream: DataiNetX™'s 47 proprietary features do the heavy lifting, because a simple model on brilliant features beats a complex model on raw data. The model's internal architecture and training parameters are proprietary to CYBERINE Labs.
| Your Action | Signal | Weight | Why |
|---|---|---|---|
| Block a number | SPAM | 1.5x | Strong spam signal |
| Report spam | SPAM | 2.0x | Strongest — explicit confirmation |
| Quick hang-up | SPAM | 0.8x | Weak — could be accidental |
| Ignore repeated | SPAM | 0.7x | Weak — passive rejection |
| Whitelist | SAFE | 2.0x | Strongest safe — explicit trust |
| Answer (full call) | SAFE | 1.2x | Moderate — user engaged |
| Call back | SAFE | 1.5x | Strong safe — voluntary contact |
Everything the model learns persists in local storage on your device and survives app restarts.
All 47 features extracted and all ML predictions run entirely on your device. No cloud servers, no API calls for threat data.
Neural network weights trained and stored exclusively in your phone's local storage.
Release builds strip all personally identifiable information. Phone numbers and contact names never in system logs.
Threat databases downloaded and stored locally. Full call screening works offline after initial setup.
STIR/SHAKEN status comes from your carrier's network — SPAM-JAMR reads it, never sends it.