Message authenticity and risk assessment
AssigneeAgari Data, Inc.
InventorsScot Free Kennedy, Vidur Apparao, Kevin Mandich
Life of this patent
Estimating the term…
Abstract
Assessing a risk of a message is disclosed. A sender specified by the message is identified. A measure of authenticity that the sender specified by the message is an actual sender of the message is determined using at least one sender model associated with the sender. The sender model was at least in part automatically generated using one or more previously observed messages. The measure of authenticity is utilized to perform a risk assessment of the message.
Claims20
A system, comprising:
- a communication interface configured to receive an electronic message;
- and
- a processor coupled with the communication interface and configured to:
- identify a sender specified by the message based at least in part on an internet protocol (IP) address associated with the electronic message;
- determine a measure of authenticity that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message is within or adjacent to a block of IP addresses that are known or authorized to send messages for the sender;
- utilize the measure of authenticity to determine a measure of risk associated with the electronic message;
- and
- deliver the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.
A method, comprising:
- receiving an electronic message;
- identifying a sender specified by the message based at least in part on an internet protocol (IP) address associated with the electronic message;
- determining a measure of authenticity that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message is within or adjacent to a block of IP addresses that are known or authorized to send messages for the sender;
- utilizing the measure of authenticity to determine a measure of risk associated with the electronic message;
- and
- delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.
A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving an electronic message;
- identifying a sender specified by the message based at least in part on an internet protocol (IP) address associated with the electronic message;
- determining a measure of authenticity that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message is within or adjacent to a block of IP addresses that are known or authorized to send messages for the sender;
- utilizing the measure of authenticity to determine a measure of risk associated with the electronic message;
- and
- delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.
Dependencies are inferred from the claim text.