MAIL PROTECTION SYSTEM
A system for characterizing email communications. Mail is first processed by a Sending Entity Identifier (SEI), to determine which person, company, or type of sender the mail appears to be from, answering the question “What entity would a typical human conclude this email is from”? The output of the SEI will typically be a person (“John Doe”) or a brand (“Amazon”). The SEI passes that information, along with the email itself, to a Sending Entity Verifier (SEV), to verify whether the email really is from the entity the SEI says it's from. A Markup Engine may add a human-readable banner and/or machine-readable headers and then pass the email to a Disposition Engine which may deliver, quarantine, or folder the email (e.g., to a Junk Folder) accordingly.
1 . An automated method for determining if an email is a forgery comprising:
A. programmatically identifying who an apparent sender of the email is visually perceived to be by a human, by at least one of:
determining if the apparent sender is associated with a brand by the steps of:
when a hyperlink or domain name is found in the email;
tokenizing the hyperlink and/or domain name to provide a token;
matching the token against a list of brand names;
when an image is found in the email;
optionally segmenting the image to provide an image segment;
matching the image or an image segment against a list of brand name images;
when there is prominent text found in the email;
matching the prominent text against a list of brand names;
determining if the apparent sender is an individual by:
maintaining a social graph using a to: and from: and/or cc: fields in received emails; and
matching the to: field in the email against the graph of received emails
B. determining an actual sender of the email by the steps of:
when the apparent sender is a brand;
comparing one or more attributes of a digital signature of the email using a sender domain authentication protocol;
when the apparent sender is a person;
using one or more heuristics including one or more of
trust on first use;
matching the apparent sender against the social graph; and
C. determining the email is a forgery if the apparent sender does not match the actual sender.
2 . The method of claim 1 additionally comprising:
clustering sender domains associated with a given brand in the list of brand names.
3 . The method of claim 1 wherein the step of determining the email is a forgery further depends on a weighted score assigned to the result of one or more of the determining steps.
4 . The method of claim 1 further considering any colors, fonts or other visual attributes when matching the prominent text.
5 . The method of claim 1 additionally comprising:
ignoring any parts of the email that include text marked invisible, too small to be read, or with a font color that has insufficient contrast against a background color.
6 . The method of claim 1 additionally
when the email includes a copyright or trademark symbol,
matching an adjacent name against the list of brand names
7 . The method of claim 1 where the social graph further maintains a data structure for each sender that includes one or more attributes indicative of emails typically from the sender.
8 . The method of claim 1 wherein the matching step may include matching by exact, substring, edit-distance, Unicode skeleton, nickname, phonetic, soundex, metaphone, double-metaphone matching) of any subset of an email address, name, or description.
9 . The method of claim 1 wherein the authentication protocol is DKIM or SPF.
10 . The method of claim 1 wherein the graph includes time stamps in each profile, such that newer messages are weighted more than older messages.
11 . The method of claim 1 additionally comprising:
enabling a user to indicate feedback as to whether they think the email was a forgery, while maintaining an encrypted raw copy of the email.