Message authenticity and risk assessment

A method, comprising:

• receiving an electronic message;
• identifying a sender specified by the electronic message based at least in part on an internet protocol (IP) address associated with the electronic message;
• determining a measure of authenticity that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, including by:
• determining whether the IP address associated with the electronic message is within or adjacent to a block of IP addresses that are known or authorized to send messages for the sender;
• determining a neighborhood component factor value based on the determining of whether the IP address associated with the electronic message is within or adjacent to the block of IP addresses that are known or authorized to send messages for the sender;
• determining whether one or more attributes included in a body of the message match attributes historically seen in bodies of legitimate messages sent by the sender;
• and
• determining a message attribute component factor value based on the determining of whether the one or more attributes included in the body of the message match attributes historically seen in the bodies of the legitimate messages sent by the sender;
• utilizing the measure of authenticity to determine a measure of risk associated with the electronic message, wherein the measure of authenticity is based at least in part on the neighborhood component factor value and the message attribute component factor value, wherein the measure of risk identifies a likelihood that the electronic message is an undesired message;
• and
• delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving an electronic message;
• identifying a sender specified by the electronic message based at least in part on an internet protocol (IP) address associated with the electronic message;
• determining a measure of authenticity that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, including by:
• determining whether the IP address associated with the electronic message is within or adjacent to a block of IP addresses that are known or authorized to send messages for the sender;
• determining a neighborhood component factor value based on the determining of whether the IP address associated with the electronic message is within or adjacent to the block of IP addresses that are known or authorized to send messages for the sender;
• determining whether one or more attributes included in a body of the message match attributes historically seen in bodies of legitimate messages sent by the sender;
• and
• determining a message attribute component factor value based on the determining of whether the one or more attributes included in the body of the message match attributes historically seen in the bodies of the legitimate messages sent by the sender;
• utilizing the measure of authenticity to determine a measure of risk associated with the electronic message, wherein the measure of authenticity is based at least in part on the neighborhood component factor value and the message attribute component factor value, wherein the measure of risk identifies a likelihood that the electronic message is an undesired message;
• and
• delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.