Message Management Platform for Performing Impersonation Analysis & Detection

A method, comprising:

• at a computing platform comprising at least one processor, a communication interface, and memory:
• generating, by the at least one processor, based on email data received from a plurality of user accounts, a plurality of user identification models, wherein each of the plurality of user identification models is specific to one of the user accounts;
• intercepting, by the at least one processor, a first email message from a first user account of the plurality of user accounts to a second user account of the plurality of user accounts;
• applying, by the at least one processor, a first model of the plurality of user identification models to the first email message to calculate a first plurality of feature vectors for the first email message, wherein the first model of the plurality of user identification models is specific to the first user account of the plurality of user accounts;
• applying, by the at least one processor, one or more impersonation algorithms to the first plurality of feature vectors, wherein applying the one or more impersonation algorithms to the first plurality of feature vectors indicates that the first email message is an impersonated message;
• and
• based on results of the one or more impersonation algorithms, modifying, by the at least one processor, delivery of the first email message.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• generate, based on email data received from a plurality of user accounts, a plurality of user identification models, wherein each of the plurality of user identification models is specific to one of the user accounts;
• intercept a first email message from a first user account of the plurality of user accounts to a second user account of the plurality of user accounts;
• apply a first model of the plurality of user identification models to the first email message to calculate a first plurality of feature vectors for the first email message, wherein the first model of the plurality of user identification models is specific to the first user account of the plurality of user accounts;
• apply one or more impersonation algorithms to the first plurality of feature vectors, wherein applying the one or more impersonation algorithms to the first plurality of feature vectors indicates that the first email message is an impersonated message;
• and
• based on results of the one or more impersonation algorithms, modify delivery of the first email message.