Towards a Content-based Defense against Text DDoS in 9-1-1 Emergency Systems Bal Krishna Bal, Weidong Larry Shi, Shou-Hsuan Stephen Huang, Omprakash Gnawali Department of Computer Science University of Houston {bbal, wshi3}@uh.edu, {gnawali, shuang}@cs.uh.edu Abstract—Text messaging is getting increasingly popular among all generations because it is built into the cellphone carried by people all the time. People, including those with speech and hearing disabilities, are starting to use text messages in place of voice 9-1-1 calls to call for help during emergencies and many 9-1-1 centers are starting to support text messaging. Since text messages take less bandwidth, it is more likely to be available in a major disaster than voice calls. Text messages are also useful in emergency situation such as a child hiding in a closet during a home invasion. On the other hand, text message system is also subject to abuse by hackers. In a recent attack, a teenager was able to send voice calls from a large number of smartphones to 9-1-1 call centers. That same Distributed Denial of Services (DDoS) attack can happen to text messages. While it does not fall under the policy of the call centers to filter out the incoming messages, it would be useful to do some preliminary analyses of the text messages and based on the result of those analyses determine the priority order for processing thereby helping human operators to efficiently manage the messages. In this work, we design and implement several new Natural Language Processing (NLP) techniques to analyze the contents of the incoming text messages to an emergency call center to provide insights about potential spam or DDoS attacks to 9-1-1 centers. Our preliminary results show that the task of automatically analyzing the text to determine if a text is part of an attack can be done with reasonable accuracy. I. I NTRODUCTION Text Messaging, which has already become a prominent means of communication among people of different walks of life has the potential of serving as a life saver in emergency situations like disasters, fire breakouts, medical emergencies or situations where the help of law enforcement or emergency response bodies is required. It becomes particularly useful when the voice network is too busy or when people are not in a position to make a call either because they are physically unable to do so or the prevailing circumstances are too risky to make a call. According to a recent report [1], there are more than 37 million people in the United States having speech and hearing disabilities. 83% of the American adults (age 18-24) own cellphones and about 73% send and receive text messages [2]. Among these 73%, 31% prefer text to talking over the phone. The survey further revealed that cell owners of the aforementioned age group send and receive on an average of 41.5 messages daily. These facts alone justify the need and application of text messaging systems at crucial times of life and death. Unfortunately, it is quite likely that text messages could be abused or even attacked by attackers with malicious intentions of disrupting the 9-1-1 emer- gency call centers by sending a large volume of text messages. In a typical attack scenario or at times of natural disaster, the volume of text messages could be significantly higher than the number of available human operators to handle them, thus resulting in the denial of service to genuine help seekers. While it does not fall under the policy of the emergency call centers to filter out the incoming messages, it certainly would be useful to do some preliminary analyses on the contents of the messages and based on the results of those analyses, set some priorities and provide additional contextual information about the messages so that the human operators could efficiently manage the messages. In this work, we propose a general framework of a Text Analysis Engine, whose main objec- tive is to do some pre-analysis of the incoming messages, such as determining whether it contains an address, whether the same or similar messages have been received earlier, whether the message(s)