Mitigating communication risk by detecting similarity to a trusted message contact

1. A method, comprising:

determining a measure of trust associated with a sender of a message;

determining a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

determining a measure of spoofing risk associated with the sender;

combining, at a system that includes one or more servers, the measure of similarity with at least one of the measure of trust or the measure of spoofing risk to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modifying, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message.

2. The method of claim 1 , wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a sender email address or a reply-to address of the message.

3. The method of claim 1 , wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a display name of the sender of the message.

4. The method of claim 1 , wherein modifying the message to alter the content of the data field that includes the identification of the sender includes modifying a phone number or a link to an image of the sender of the message.

5. The method of claim 1 , wherein the data field is a “From:” field of the header of the message.

6. The method of claim 1 , wherein modifying the message to alter the content of the data field that includes the identification of the sender includes deleting the identification of the sender of the message prior to delivering the message to the recipient of the message.

7. The method of claim 1 , wherein determining the measure of similarity includes sorting elements of the identifier of the sender and sorting elements of the selected identifier of the selected trusted contact.

8. The method of claim 1 , wherein determining the measure of similarity includes determining a string similarity measure between the identifier of the sender and the selected identifier of the selected trusted contact.

9. The method of claim 1 , wherein determining the measure of similarity includes detecting substitution characters in the identifier of the sender.

10. The method of claim 1 , wherein the identifier of the sender includes an email address or a display name of the sender and the selected identifier of the selected trusted contact includes an email address or a display name of the selected trusted contact.

11. The method of claim 1 , wherein the plurality of trusted contacts of the recipient was identified at least in part by the recipient of the message.

12. The method of claim 1 , wherein the plurality of trusted contacts of the recipient was identified at least in part based on contacts included an address book of the recipient of the message.

13. The method of claim 1 , wherein the plurality of trusted contacts of the recipient was automatically identified at least in part by analyzing previous messages sent and received by the recipient.

14. The method of claim 1 , wherein the plurality of trusted contacts of the recipient was identified at least in part by analyzing previous messages sent and received by a plurality of different message accounts of a same network domain of the recipient.

15. The method of claim 1 , wherein the selected identifier of the selected trusted contact was obtained from a subject field of the message.

16. The method of claim 1 , further comprising:

determining a first measure of reputation associated with the sender;

determining a second measure of reputation associated with the sender, wherein the first measure of reputation is associated with a longer timer period than the second measure of reputation; and

detecting a change in the second measure of reputation in light of the first measure of reputation, wherein the message is filtered based at least in part on the detected change.

17. The method of claim 1 , further comprising determining a measure of control of a network domain of the sender the message, wherein the message is filtered based at least in part on the measure of control of the network domain.

18. The method of claim 1 , wherein the spoofing risk is based at least in part a message validation policy associated with a network domain of the sender.

19. A system, comprising:

a processor configured to:

determine a measure of trust associated with a sender of a message;

determine a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

determine a measure of spoofing risk associated with the sender;

combine the measure of similarity with at least one of the measure of trust or the measure of spoofing risk to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modify, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message; and

a memory coupled to the processor and configured to provide the processor with instructions.

20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining a measure of trust associated with a sender of a message;

determining a measure of similarity between an identifier of the sender of the message and each identifier of one or more identifiers of each trusted contact of a plurality of trusted contacts of a recipient of the message;

determining a measure of spoofing risk associated with the sender;

combining the measure of similarity with at least one of the measure of trust or the measure of spoofing risk to determine a combined measure of risk associated with the message, wherein the sender of the message is not any of the trusted contacts but at least one of the measure of similarity between the identifier of the sender of the message and a selected identifier of a selected trusted contact of the plurality of trusted contacts meets a threshold; and

based at least in part on the combined measure of risk associated with the message, modifying, at the system that includes the one or more servers, the message to alter content of a data field that includes an identification of the sender of the message, wherein the data field is one of a plurality of data fields included in a header of the message.