Mitigating communication risk by detecting similarity to a trusted message contact

• US 9,847,973 B1
• Filed: 03/08/2017
• Issued: 12/19/2017
• Est. Priority Date: 09/26/2016
• Status: Active Grant

• Current Assignee: Agari Data, Inc.
• Original Assignee: Agari Data, Inc.
• Inventors: Jakobsson, Bjorn Markus, Loder, Theodore C., Rideout, Jacob R., Jakobsson, Arthur Kwan, Jones, Michael L.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/453,737
• Time in Patent Office: 286 Days
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0254 Stateful filtering
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A measure of similarity between an identifier of a sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message is determined. In the event the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold, the message is modified, if applicable, to alter content of a data field that includes an identification of the sender of the message. The data field is one of a plurality of data fields included in a header of the message.

Claims

1. A method, comprising:

determining a measure of trust associated with a sender of a message;

determining based at least in part on a spoofing risk, a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

combining, at a system that includes one or more servers, the measure of trust and the measure of similarity to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modifying, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message.

2. The method of claim 1, wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a sender email address or a reply-to address of the message.

3. The method of claim 1, wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a display name of the sender of the message.

4. The method of claim 1, wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a phone number or a link to an image of the sender of the message.

5. The method of claim 1, wherein the data field is a “

From;

”

field of the header of the message.

6. The method of claim 1, wherein modifying the message to alter the content of the data field that includes the identification of the sender includes deleting the identification of the sender of the message prior to delivering the message to the recipient of the message.

7. The method of claim 1, wherein determining the measure of similarity includes sorting elements of the identifier of the sender and sorting elements of the selected identifier of the selected trusted contact.

8. The method of claim 1, wherein determining the measure of similarity includes determining a string similarity measure between the identifier of the sender and the selected identifier of the selected trusted contact.

9. The method of claim 1, wherein determining the measure of similarity includes detecting substitution characters in the identifier of the sender.

10. The method of claim 1, wherein the identifier of the sender includes an email address or a display name of the sender and the selected identifier of the selected trusted contact includes an email address or a display name of the selected trusted contact.

11. The method of claim 1, wherein the plurality of trusted contacts of the recipient was identified at least in part by the recipient of the message.

12. The method of claim 1, wherein the plurality of trusted contacts of the recipient was is identified at least in part based on contacts included an address book of the recipient of the message.

13. The method of claim 1, wherein the plurality of trusted contacts of the recipient was automatically identified at least in part by analyzing previous messages sent and received by the recipient.

14. The method of claim 1, wherein the plurality of trusted contacts of the recipient was identified at least in part by analyzing previous messages sent and received by a plurality of different message accounts of a same network domain of the recipient.

15. The method of claim 1, wherein the selected identifier of the selected trusted contact was obtained from a subject field of the message.

16. The method of claim 1, further comprising:

determining a first measure of reputation associated with the sender;

determining a second measure of reputation associated with the sender, wherein the first measure of reputation is associated with a longer timer period than the second measure of reputation; and

detecting a change in the second measure of reputation in light of the first measure of reputation, wherein the message is filtered based at least in part on the detected change.

17. The method of claim 1, further comprising determining a measure of control of a network domain of the sender the message, wherein the message is filtered based at least in part on the measure of control of the network domain.

18. The method of claim 1, wherein the spoofing risk is based at least in part a message validation policy associated with a network domain of the sender.

19. A system, comprising:

a processor configured to;

determine a measure of trust associated with a sender of a message;

determine based at least in part on a spoofing risk, a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

combine, at the system that includes one or more servers, the measure of trust and the measure of similarity to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modify, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message; and

a memory coupled to the processor and configured to provide the processor with instructions.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining a measure of trust associated with a sender of a message;

determining based at least in part on a spoofing risk, a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

combining, at a system that includes one or more servers, the measure of trust and the measure of similarity to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modifying, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message.