Using a measure of influence of sender in determining a security risk associated with an electronic message
A measure of influence of a sender entity is determined for a message receiving entity based at least in part on an analysis of previous electronic messages sent by the sender entity. An electronic message associated with the sender entity is received. The measure of influence of the sender entity is utilized to determine a security risk associated with the received electronic message.
1. A method for electronic message security risk analysis, comprising:
determining a measure of influence of a sender entity for a message receiving entity based at least in part on an analysis of previous electronic messages sent by the sender entity;
receiving an electronic message associated with the sender entity;
utilizing the measure of influence of the sender entity to determine using a processor a security risk associated with the received electronic message, wherein the measure of influence is based on a numerical magnitude value quantifying a magnitude of a specific relationship role based at least in part on an organizational reporting relationship between the specific message receiving entity of the message and the specific sender entity according to an organizational reporting hierarchy and utilizing the measure of influence of the sender entity to determine the security risk associated with the received electronic message includes attributing an additional increase to the security risk of the received electronic message in response to a determination that the measure of influence based on the magnitude of the specific relationship role between the specific message receiving entity and the specific sender entity exceeds a threshold associated with the organizational reporting hierarchy; and
in response to attributing the additional increased risk to the received electronic message due to the measure of influence, triggering a security action based on the additional increased security risk, wherein the security action includes one or more of the following: sending a verification challenge to an alternative contact of the sender entity, performing additional analysis of the received electronic message, quarantining the received electronic message, blocking the received electronic message, executing an executable included in the received electronic message in a sandbox or a virtual machine, adding a warning to the received electronic message, or moving the received electronic message to a different folder.
2. The method of claim 1 , wherein the measure of influence is based at least in part on a role of the sender entity within an organization.
3. The method of claim 1 , wherein the measure of influence is based at least in part on a role of the message receiving entity within an organization.
4. The method of claim 1 , wherein the measure of influence is based at least in part on a number of electronic messages included in a volume of the previous electronic messages sent by the sender entity to the message receiving entity within a specified period of time.
5. The method of claim 1 , wherein the measure of influence is based at least in part on a number of different message recipients in a volume of the previous electronic messages sent by the sender entity.
6. The method of claim 1 , wherein the measure of influence is based at least in part on one or more identified keywords in the previous electronic messages sent by the sender entity to the message receiving entity.
7. The method of claim 1 , wherein the message receiving entity includes a plurality of individual recipients belonging to a common organization.
8. The method of claim 1 , wherein the message receiving entity is an individual message recipient, the measure of influence quantifies a determined influence of the sender entity on the individual message recipient, the measure of influence is one of a plurality of measures of influence of the sender entity, and each of the plurality of measures of influence of the sender entity corresponds to a different individual message recipient.
9. The method of claim 1 , wherein the measure of influence is based at least in part on a user provided specification of a relationship between the sender entity and the message receiving entity.
10. The method of claim 1 , wherein determining the security risk associated with the received electronic message includes scaling an impersonation risk score based on the measure of influence, and the impersonation risk score is determined including by determining whether the electronic message appears as having been sent from the sender entity but is actually sent from a source not trusted to be associated with the sender entity.
11. The method of claim 10 , wherein the electronic message appears as having been sent from the sender entity due to a similarity between a sender display name identified in the electronic message and a known display name of the sender entity.
12. The method of claim 10 , wherein the electronic message is identified as having been sent from the source not trusted to be associated with the sender entity including by determining that a sender email address identified in the electronic message is not known to be associated with the sender entity.
13. The method of claim 1 , wherein determining the security risk associated with the received electronic message includes determining whether the electronic message was sent from a message account belonging to a list of message accounts trusted to be associated with the sender entity.
14. The method of claim 13 , wherein the list of message accounts trusted to be associated with the sender entity is at least in part identified by a user.
15. The method of claim 13 , wherein the list of message accounts trusted to be associated with the sender entity is at least in part automatically identified based on the previous electronic messages sent by the sender entity.
16. The method of claim 13 , wherein the list of message accounts trusted to be associated with the sender entity is at least in part automatically identified based on an identification of a service identified as being utilized by the sender entity and known to send electronic messages on behalf of the sender entity.
17. The method of claim 1 , wherein determining the security risk includes determining a plurality of risk component scores and combining the plurality of risk component scores to determine an overall risk score of the security risk and at least one of the plurality of risk component scores is based at least in part on the measure of influence.
18. A system for electronic message security risk analysis, comprising:
a hardware processor; and
a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
determine a measure of influence of a sender entity for a message receiving entity based at least in part on an analysis of previous electronic messages sent by the sender entity;
receive an electronic message associated with the sender entity;
utilize the measure of influence of the sender entity to determine a security risk associated with the received electronic message, wherein the measure of influence is based on a numerical magnitude value quantifying a magnitude of a specific relationship role based at least in part on an organizational reporting relationship between the specific message receiving entity of the message and the specific sender entity according to an organizational reporting hierarchy and utilizing the measure of influence of the sender entity to determine the security risk associated with the received electronic message includes attributing an additional increase to the security risk of the received electronic message in response to a determination that the measure of influence based on the magnitude of the specific relationship role between the specific message receiving entity and the specific sender entity exceeds a threshold associated with the organizational reporting hierarchy; and
in response to attributing the additional increased risk to the received electronic message due to the measure of influence, trigger a security action based on the additional increased security risk, wherein the security action includes one or more of the following: sending a verification challenge to an alternative contact of the sender entity, performing additional analysis of the received electronic message, quarantining the received electronic message, blocking the received electronic message, executing an executable included in the received electronic message in a sandbox or a virtual machine, adding a warning to the received electronic message, or moving the received electronic message to a different folder.
19. The system of claim 18 , wherein the message receiving entity is an individual message recipient, the measure of influence quantifies a determined influence of the sender entity on the individual message recipient, the measure of influence is one of a plurality of measures of influence of the sender entity, and each of the plurality of measures of influence of the sender entity corresponds to a different individual message recipient.
20. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium for electronic message security risk analysis and comprising computer instructions for:
determining a measure of influence of a sender entity for a message receiving entity based at least in part on an analysis of previous electronic messages sent by the sender entity;
receiving an electronic message associated with the sender entity;
utilizing the measure of influence of the sender entity to determine a security risk associated with the received electronic message, wherein the measure of influence is based on a numerical magnitude value quantifying a magnitude of a specific relationship role based at least in part on an organizational reporting relationship between the specific message receiving entity of the message and the specific sender entity according to an organizational reporting hierarchy and utilizing the measure of influence of the sender entity to determine the security risk associated with the received electronic message includes attributing an additional increase to the security risk of the received electronic message in response to a determination that the measure of influence based on the magnitude of the specific relationship role between the specific message receiving entity and the specific sender entity exceeds a threshold associated with the organizational reporting hierarchy; and
in response to attributing the additional increased risk to the received electronic message due to the measure of influence, triggering a security action based on the additional increased security risk, wherein the security action includes one or more of the following: sending a verification challenge to an alternative contact of the sender entity, performing additional analysis of the received electronic message, quarantining the received electronic message, blocking the received electronic message, executing an executable included in the received electronic message in a sandbox or a virtual machine, adding a warning to the received electronic message, or moving the received electronic message to a different folder.