Message authenticity and risk assessment

1. A system, comprising:

a communication interface configured to receive an electronic message; and

a processor coupled with the communication interface and configured to:

identify a sender specified by the electronic message based at least in part on an internet protocol (IP) address associated with the electronic message;

determine a measure of reputation value of the sender that is based on a global reputation of the sender and a local reputation of the sender, wherein the global reputation of the sender is based at least in part on a comparison between the IP address associated with the electronic message and known non-reputable IP addresses, wherein the local reputation is based at least in part on a message history between the sender and a recipient of the electronic message;

determine a measure of authenticity value that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message matches one or more IP addresses associated with message servers that are known or authorized to send messages for the sender, wherein the measure of authenticity value is based at least in part on whether the IP address of a server that sent the electronic message is specified in the at least one sender model, wherein the measure of authenticity value is based at least in part on whether the IP address of the server that sent the electronic message is associated with one or more of the following specified in the at least one sender model: a range/block of IP addresses, a network hostname/domain, and an autonomous system number;

utilize the measure of reputation value and the measure of authenticity value to determine a measure of risk associated with the electronic message; and

deliver the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.

2. The system of claim 1 , wherein the system is an email gateway server.

3. The system of claim 1 , wherein identifying the sender specified by the electronic message includes identifying a network domain of the sender of the electronic message.

4. The system of claim 1 wherein the at least one sender model specifies message properties that are characteristic of authentic messages sent by or on behalf of the sender.

5. The system of claim 4 , wherein the measure of authenticity value is based at least in part by comparing message properties of the electronic message to the message properties specified in the at least one sender model.

6. The system of claim 1 , wherein the at least one sender model specifies one or more of the following determined to be associated with the sender: one or more IP addresses, one or more ranges/blocks of IP addresses, one or more network hostnames/domains, and one or more autonomous system numbers.

7. The system of claim 1 , wherein the at least one sender model was at least in part automatically generated using one or more previously received messages from the sender.

8. The system of claim 1 , wherein the measure of reputation value of the sender identifies a general likelihood that the sender would send a message that is of value to a recipient.

9. The system of claim 1 , wherein the local reputation of the sender is specific to the recipient of the electronic message.

10. The system of claim 1 , wherein the measure of reputation value of the sender is based at least in part on a domain registration history of the sender.

11. The system of claim 1 , wherein the measure of reputation value of the sender is based at least in part on the Domain Name Service activity of the sender.

12. The system of claim 1 , wherein the measure of reputation value of the sender is based at least in part on a statistic of a history of messages sent by the sender.

13. The system of claim 1 , wherein the measure of reputation value of the sender is based at least in part on a similarity factor value that indicates whether a domain of the sender mimics a domain of another sender.

14. The system of claim 1 , wherein the measure of risk identifies a likelihood that the electronic message is an undesired message.

15. The system of claim 1 , wherein the measure of risk for the electronic message corresponds to the measure of authenticity value and the measure of reputation value of the sender.

16. The system of claim 1 , wherein the processor is further configured to determine whether to deliver the electronic message.

17. The system of claim 1 , wherein the processor is further configured to label the electronic message or report a risk associated with the electronic message.

18. The system of claim 1 , wherein the processor is further configured to determine that the electronic message has been validated using a message authentication/validation system, wherein the measure of authenticity value is set to a value based on a determination that the received electronic message has been validated using a message authentication/validation system.

19. The system of claim 1 , wherein the processor is further configured to determine that identified IP address associated with the electronic message is authorized or historically known to send legitimate messages for the sender based on the at least one sender model, wherein an individual IP component factor value for the measure of authentication value is determined based on a determination that identified IP address associated with the electronic message is authorized or historically known to send legitimate messages for the sender based on the at least one sender model, wherein the measure of authenticity value is based in part on the individual IP component factor value.

20. The system of claim 1 , wherein the processor is further configured to determine that one or more other attributes of the electronic message match attributes historically seen in legitimate messages sent for the identified sender, wherein the one or more other attributes of the electronic message have a corresponding message attribute component factor value, wherein the measure of authenticity value is based in part on the corresponding message attribute component factor values of the one or more other attributes of the electronic message.

21. The system of claim 1 , wherein the processor is further configured to determine that an organization domain of a hostname/domain name result of a reverse DNS lookup matches a domain of the sender of the electronic message, wherein a hostname-match component factor value is determined based on the determination that the organization domain of the hostname/domain name result of the reverse DNS lookup matches the domain of the sender of the electronic message, wherein the measure of authenticity value is based in part on the hostname-match component factor value.

22. The system of claim 1 , wherein the measure of authenticity value is based in part on one or more of a message authentication/validation system validation, an individual IP component factor value, a message attribute component factor value, and/or a hostname-match component value.

23. A method, comprising:

receiving an electronic message;

identifying a sender specified by the electronic message based at least in part on an internet protocol (IP) address associated with the electronic message;

determining, by a processor, a measure of reputation value of the sender that is based on a global reputation of the sender and a local reputation of the sender, wherein the global reputation of the sender is based at least in part on a comparison between the IP address associated with the electronic message and known non-reputable IP addresses, wherein the local reputation is based at least in part on a message history between the sender and a recipient of the electronic message;

determining, by the processor, a measure of authenticity value that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message matches one or more IP addresses associated with message servers that are known or authorized to send messages for the sender, wherein the measure of authenticity value is based at least in part on whether the IP address of a server that sent the electronic message is specified in the at least one sender model, wherein the measure of authenticity value is based at least in part on whether the IP address of the server that sent the electronic message is associated with one or more of the following specified in the at least one sender model: a range/block of IP addresses, a network hostname/domain, and an autonomous system number;

utilizing the measure of reputation value and the measure of authenticity value to determine a measure of risk associated with the electronic message; and

delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.

24. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

receiving an electronic message;

identifying a sender specified by the electronic message based at least in part on an internet protocol (IP) address associated with the electronic message;

determining a measure of reputation value of the sender that is based on a global reputation of the sender and a local reputation of the sender, wherein the global reputation of the sender is based at least in part on a comparison between the IP address associated with the electronic message and known non-reputable IP addresses, wherein the local reputation is based at least in part on a message history between the sender and a recipient of the electronic message;

determining a measure of authenticity value that the sender specified by the electronic message is an actual sender of the electronic message using at least one sender model associated with the sender, wherein the at least one sender model is configured to determine whether the IP address associated with the electronic message matches one or more IP addresses associated with message servers that are known or authorized to send messages for the sender, wherein the measure of authenticity value is based at least in part on whether the IP address of a server that sent the electronic message is specified in the at least one sender model, wherein the measure of authenticity value is based at least in part on whether the IP address of the server that sent the electronic message is associated with one or more of the following specified in the at least one sender model: a range/block of IP addresses, a network hostname/domain, and an autonomous system number;

utilizing the measure of reputation value and the measure of authenticity value to determine a measure of risk associated with the electronic message; and

delivering the electronic message to a recipient of the electronic message based on whether the determined measure of risk is above a delivery threshold.