Imposter Prediction Using Historical Interaction Patterns

An information handling system comprising:

• one or more processors;
• a memory coupled to at least one of the processors;
• a nonvolatile storage device accessible by at least one of the processors;
• a network interface that connects the information handling system to a network;
• a display screen coupled to at least one of the processors;
• and
• a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:
• receiving, from a source, an electronic message at the network interface;
• identifying a source address corresponding to the electronic message, wherein the source address also corresponds to a legitimate source;
• extracting one or more current usage patterns from the received electronic message;
• retrieving, from the nonvolatile storage device, one or more historical usage patterns corresponding to the identified source address, wherein the historical usage patterns were previously gathered from one or messages received from the legitimate source;
• comparing the extracted current usage patterns to the retrieved historical usage patterns;
• and
• notifying a user of the information handling system in response to the comparison revealing that the source is an imposter.

A computer program product stored in a computer readable storage medium, comprising computer program code that, when executed by an information handling system, causes the information handling system to perform actions comprising:

• receiving, from a source, an electronic message at a network interface accessible from the information handling system;
• identifying a source address corresponding to the electronic message, wherein the source address also corresponds to a legitimate source;
• extracting one or more current usage patterns from the received electronic message;
• retrieving, from a nonvolatile data store, one or more historical usage patterns corresponding to the identified source address, wherein the historical usage patterns were previously gathered from one or messages received from the legitimate source;
• comparing the extracted current usage patterns to the retrieved historical usage patterns;
• and
• notifying a user of the information handling system in response to the comparison revealing that the source is an imposter.