Message security assessment using sender identity profiles
An identity profile of a user is tracked using previous message communications of the user. A message identified as potentially from the user is received. The identity profile of the user is identified and obtained. Information is extracted from a header of the received message. A security risk assessment of the received message is determined at least in part by comparing the extracted information with one or more corresponding entries of the identity profile of the user. A security action is performed based on the determined security risk assessment.
1. A method, comprising:
tracking an identity profile of a user using previous message communications of the user;
receiving a message identified as potentially from the user;
identifying and obtaining the identity profile of the user;
extracting information from a header of the received message;
determining a security risk assessment of the received message at least in part by comparing the extracted information with one or more corresponding entries of the identity profile of the user including by detecting a change between at least a portion of the extracted information and at least one entry of the identity profile of the user and evaluating the detected change based on a likelihood-of-change probability associated with a likelihood that the at least one entry of the identity profile would change over time, wherein the likelihood-of-change probability is determined using previously detected changes over time in the previous message communications of the user including by computing a measurement of a distribution of a frequency of changes between different types of mail user agents used by the user; and
performing a security action based on the determined security risk assessment.
2. The method of claim 1 , wherein the likelihood-of-change probability is determined not using the detected change but only using the previously detected changes over time in the previous message communications of the user.
3. The method of claim 1 , wherein the extracted information includes information identifying an operating system used by a sender of the received message.
4. The method of claim 1 , wherein the extracted information includes information identifying a computer network used by a sender of the received message.
5. The method of claim 1 , wherein the extracted information includes information identifying a script used by a sender of the received message.
6. The method of claim 1 , wherein identifying and obtaining the identity profile of the user includes identifying the identity profile of the user with a display name of a sender of the received message.
7. The method of claim 1 , wherein determining the security risk assessment includes determining that the user of the identity profile is likely not a sender of the received message.
8. The method of claim 1 , wherein comparing the extracted information with the one or more corresponding entries of the identity profile of the user includes determining that although a mail user agent utilized by the received message does not exactly match a mail user agent specified in the identity profile, the mail user agent utilized by the received message is a newer version of the mail user agent utilized specified in the identity profile.
9. The method of claim 1 , wherein determining the security risk assessment of the received message includes determining that the message has likely been compromised by a phishing attack at least in part by determining that a sender message account of the received message matches an entry in the identity profile as a trusted message account but a device identifier extracted from the received message does not match a trusted device identifier in the identity profile and a network utilized to send the received message does not match a trusted network specified in the identity profile.
10. The method of claim 1 , wherein determining the security risk assessment of the received message includes determining that the received message is likely a part of a display name deception attack at least in part by determining that a sender message account of the received message does not match an entry in the identity profile but a sender display name of the received message matches an entry in the identity profile and a device identifier extracted from the received message does not match a trusted device identifier in the identity profile and a network utilized to send the received message does not match a trusted network specified in the identity profile.
11. The method of claim 1 , wherein determining the security risk assessment of the received message includes determining that the received message was sent by malware at least in part by determining that the received message was sent using automation but the identity profile does not identify the user as being trusted to send messages using automation.
12. The method of claim 1 , wherein determining the security risk assessment of the received message includes determining that the received message was sent by the user despite a network utilized to send the received message not matching a trusted network specified in the identity profile at least in part because a sender message account of the message matches an entry in the identity profile as a trusted message account and a device identifier extracted from the message matches a trusted device identifier in the identity profile.
13. The method of claim 1 , wherein performing the security action includes updating the identity profile based on the extracted information of the received message.
14. The method of claim 1 , wherein performing the security action includes adding a device identifier to the identity profile of the user based on a determination that a sufficient number of messages have been received with the device identifier from a trusted account and via a trusted network.
15. The method of claim 1 , wherein performing the security action includes adding a new message account identifier of a new account to the identity profile of the user based on a determination that a sufficient number of messages have been received from the new account specifying a trusted device identifier and a trusted network.
16. The method of claim 1 , wherein performing the security action includes modifying a display name of a sender of the message prior to allowing an intended recipient of the received message to access the received message.
17. The method of claim 1 , wherein performing the security action includes performing one or more of the following: sending a verification challenge to an alternative contact of a sender of the received message; performing additional analysis of the received message; quarantining the received message; blocking the received message; executing an executable included in the received message in a sandbox or a virtual machine; adding a warning to the received message; and moving the received message to a different folder.
18. A system, comprising:
a processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
track an identity profile of a user using previous message communications of the user;
receive a message identified as potentially from the user;
identify and obtaining the identity profile of the user;
extract information from a header of the received message;
determine a security risk assessment of the received message at least in part by comparing the extracted information with one or more corresponding entries of the identity profile of the user, including by being configured to detect a change between at least a portion of the extracted information and at least one entry of the identity profile of the user and evaluate the detected change based on a likelihood-of-change probability associated with a likelihood that the at least one entry of the identity profile would change over time, wherein the likelihood-of-change probability is determined using previously detected changes over time in the previous message communications of the user including by computing a measurement of a distribution of a frequency of changes between different types of mail user agents used by the user; and
perform a security action based on the determined security risk assessment.
19. The system of claim 18 , wherein determining the security risk assessment includes determining that the user of the identity profile is likely not a sender of the received message.
20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
tracking an identity profile of a user using previous message communications of the user;
receiving a message identified as potentially from the user;
identifying and obtaining the identity profile of the user;
extracting information from a header of the received message;
determining a security risk assessment of the received message at least in part by comparing the extracted information with one or more corresponding entries of the identity profile of the user including by detecting a change between at least a portion of the extracted information and at least one entry of the identity profile of the user and evaluating the detected change based on a likelihood-of-change probability associated with a likelihood that the at least one entry of the identity profile would change over time, wherein the likelihood-of-change probability is determined using previously detected changes over time in the previous message communications of the user including by computing a measurement of a distribution of a frequency of changes between different types of mail user agents used by the user; and
performing a security action based on the determined security risk assessment.