Gen Achieves over 90% Accuracy for Norton Genie Scam Detection Using AWS Serverless and AI Services

Gen is a global leader in consumer and small-business cyber safety, offering solutions such as antivirus, antimalware, identity and privacy protection, virtual private networks, and cloud backup. Gen includes the brands Norton, Avast, LifeLock, Avira, AVG, ReputationDefender, and CCleaner. It has nearly 500 million users worldwide.

When creating Norton Genie, Gen faced several development obstacles. The first was achieving a swift time to market. Its team wanted to develop a prototype within weeks instead of months, an incredibly quick turnaround. “Time to market is key. We wanted to build something quickly, which dictated our early decisions for technology, and that’s where AWS came in,” says Lei Gu, senior technical director at Gen. Second, because the company has products that receive billions of requests daily, it needed to engineer Norton Genie to scale without knowing the potential volume of consumer demand. Third, Gen had limited SMS scam samples available and needed to generate more data to improve the efficacy of Norton Genie.

To tackle these obstacles, Gen turned to AWS serverless services. “Using AWS serverless services, we don’t have to manage our infrastructure at all,” says Gu. “We don’t have to worry about scalability, we pay as we go, and we have the flexibility to choose the right tools to go to market.” The company worked closely alongside AWS teams to make architectural decisions, which was instrumental for Norton Genie’s development.

Gen started creating Norton Genie in March 2023, spending the first 6 weeks developing a prototype. To overcome the challenge of the paucity of data on SMS scams, the team spent time in alpha testing. Norton Genie was ready to ship by November 2023 and released to the public in January 2024.

Norton Genie is available on Android, iOS, and the web. Customers submit text or images to the application, which extracts the text and runs it through an optical character recognition pipeline. Norton Genie can differentiate between over 10 types of scams and identify locale-specific scams. Customers can also converse with Norton Genie, which uses generative AI to gather more information through contextual sleuthing.

Gen uses AWS Lambda, which is a serverless, event-driven compute service to run code for virtually any type of application or backend service without provisioning or managing servers, as a communication mechanism to call APIs. Determining the scam is a complicated process with many steps, including correcting text and extracting URLs. Gen’s solution is an event-driven architecture that breaks down complex software applications into small, independently deployable components. These components run each application process as a separate microservice, decoupling the development lifecycle.

To glue all these steps together, Gen uses AWS Step Functions, a visual workflow orchestration service. Because AWS Step Functions can be separated by task, such as cleaning text, scam detection, and efficacy, multiple teams at Gen can work together in parallel, making changes to any component of the pipeline without impacting the rest of the pipeline. The company decoupled development using AWS Step Functions, and before its backend was ready to start servicing requests, it could leave placeholders until other systems were ready. “We are making AWS Step Functions a key piece of infrastructure from the starting point of new product development,” says Gu. “It has the flexibility, scalability, and auditability we need.”

The company uses several other serverless services, including Amazon DynamoDB—a serverless, NoSQL, fully managed database service with single-digit millisecond performance at any scale—to store operational and statistical information. (See figure 1 below.) Gen has achieved over 90 percent detection accuracy of scams with Norton Genie across 1 million installations of the application and has processed 500,000 submissions so far. By using serverless architecture, AWS side response times are less than 1 second, and the application is scalable with little to no patching and maintenance required by Gen. “We haven’t hit any scale limits since the application launched,” says Michael Shavell, senior technical director at Gen. “We’ve been humming along with unbelievable stability, which has been fantastic.” Gen has also worked alongside AWS to identify places to cut costs and has optimized costs by using the pay-as-you-go model.