Impersonation detection using an authentication enforcement engine

A method comprising:

• at a computing device comprising at least one processor, a communication interface, and memory:
• receiving, from a first database, an electronic signature corresponding to a first user device;
• receiving, from a second database, a device record corresponding to the first user device;
• generating, based on the electronic signature and the device record, a profile for the first user device;
• intercepting, by monitoring network communications for a plurality of user devices, a transmission from the first user device to a second user device of the plurality of user devices;
• extracting, from the intercepted transmission, information of the transmission, wherein the information of the transmission corresponds to the first user device;
• generating, based on inputting the information of the transmission into an authentication enforcement engine, a similarity score for the first user device, wherein the similarity score indicates a similarity between the information of the transmission and the profile for the first user device;
• identifying, by comparing the similarity score to a threshold score, whether the similarity score satisfies the threshold score;
• and
• initiating, based on identifying that the similarity score fails to satisfy the threshold score, one or more security actions.

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, a communication interface, and memory, cause the computing platform to:

• receive, from a first database, an electronic signature corresponding to a first user device;
• receive, from a second database, a device record corresponding to the first user device;
• generate, based on the electronic signature and the device record, a profile for the first user device;
• intercept, by monitoring network communications for a plurality of user devices, a transmission from the first user device to a second user device of the plurality of user devices;
• extract, from the intercepted transmission, information of the transmission, wherein the information of the transmission corresponds to the first user device;
• generate, based on inputting the information of the transmission into an authentication enforcement engine, a similarity score for the first user device, wherein the similarity score indicates a similarity between the information of the transmission and the profile for the first user device;
• identify, by comparing the similarity score to a threshold score, whether the similarity score satisfies the threshold score;
• and
• initiate, based on identifying that the similarity score fails to satisfy the threshold score, one or more security actions.