System for detecting fraudulent electronic communications impersonation, insider threats and attacks

An apparatus for characterizing communications going to and from a first domain, the apparatus comprising:

• a processor;
• and
• a memory containing program instructions that when executed by the processor cause the processor to manage a fraudulent communications detection system and to, for a predetermined time period, obtain each communication going to and from the first domain and:
• analyze one or more parameters of the obtained communication;
• store the analyzed one or more parameters of the obtained communication with respect to a sender of the obtained communication and one or more recipients of the obtained communication;
• extrapolate and characterize each of one or more relationships among the sender and the one or more recipients of the obtained communication as a function of the analyzed one or more parameters;
• and
• update a store of extrapolated relationships and associated characterizations of communications among the sender and the one or more recipients of the obtained communication,
• wherein the store of extrapolated relationships and associated characterizations of communications among the sender and the one or more recipients is operative to improve operation of the fraudulent communications detection system associated with the processor.