Detecting phishing attempts

1. A classification system for detecting attempted deception in an electronic communication, comprising:

a client device used to access the electronic communication addressed to a user of the client device;

at least one of a profile and content database; and

at least one server in communication with the client device and the at least one of the profile and content database, the at least one server comprising:

an interface configured to receive the electronic communication; and

a set of one or more processors configured to:

determine, by at least one classifier component, that the electronic communication appears to have been transmitted on behalf of an authoritative entity by:

computing a similarity distance between a first item from the electronic communication and a second item associated with the authoritative entity, wherein the second item associated with the authoritative entity is retrieved from the at least one of the profile and content database, wherein the similarity distance is computed by performing a match between at least one of:

 the first item comprising a display name of the electronic communication and the second item comprising a display name of the authoritative entity,

 the first item comprising an email address of a sender of the electronic communication and the second item comprising an email address of the authoritative entity,

 the first item comprising at least a part of a text comprising the electronic communication and the second item comprising at least a part of a text associated with the authoritative entity; and

 the first item comprising a header associated with the electronic communication and the second item comprising a header associated with the authoritative entity,

 wherein the match is determined by at least one of:

 determining that first item and the second item are the same, determining that the first item and the second item have a Hamming distance below a first threshold value, determining that the first item and the second item have an edit distance below a second threshold value, determining that a support vector machine indicates a similarity between the first item and the second item based on previously trained examples, determining a similarity score based on how many characters in the second item were replaced by characters in the first item and performing at least one normalization prior to performing the match;

determine, by the at least one classifier component, that the electronic communication was not transmitted with an authorization from the authoritative entity;

based at least in part on determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity and determining that the electronic communication was not transmitted with the authorization from the authoritative entity, perform a security action comprising at least one of: erasing the electronic communication, marking up the electronic communication at least in part by adding a warning or an explanation, flagging the electronic communication, forwarding the electronic communication to a third party, placing the electronic communication in a spam folder, and forwarding the electronic communication to a repository; and

a memory coupled to the set of one or more processors and configured to provide the set of one or more processors with instructions.

2. The classification system of claim 1 wherein determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity includes evaluating the text present in a body portion of the electronic communication.

3. The classification system of claim 2 wherein determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity includes performing one or more pre-processing operations on the text comprising the electronic communication, including a normalization.

4. The classification system of claim 2 wherein evaluating the at least a part of the text comprising the electronic communication and the at least a part of the text associated with the authoritative entity includes using a collection of terms.

5. The classification system of claim 2 wherein performing the match between the first item comprising at least part of the text comprising the electronic communication and the second item comprising the at least a part of the text associated with the authoritative entity includes performing an equivalence analysis.

6. The classification system of claim 2 wherein determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity includes evaluating one or more images.

7. The classification system of claim 6 wherein evaluating the one or more images includes performing optical character recognition on the one or more images.

8. The classification system of claim 6 wherein evaluating the one or more images includes performing edge detection analysis.

9. The classification system of claim 6 wherein evaluating the one or more images includes performing color pattern analysis.

10. The classification system of claim 6 wherein the one or more images are linked to the electronic communication.

11. The classification system of claim 1 wherein determining whether the electronic communication appears to have been transmitted on behalf of the authoritative entity includes evaluating a non-sender email address included in the electronic communication.

12. The classification system of claim 1 wherein determining that the electronic communication was not transmitted with the authorization from the authoritative entity includes determining whether the electronic communication was authenticated by the authoritative entity.

13. The classification system of claim 1 wherein determining that the electronic communication was not transmitted with authorization from the authoritative entity includes evaluating a delivery path associated with the electronic communication.

14. A method for detecting attempted deception in an electronic communication, comprising:

receiving, by at least one server, the electronic communication addressed to a user of a client device;

determining, by at least one classifier component executing on one or more processors, that the electronic communication appears to have been transmitted on behalf of an authoritative entity by:

computing a similarity distance between a first item from the electronic communication and a second item associated with the authoritative entity, wherein the second item associated with the authoritative entity is retrieved from the at least one of a profile and content database, wherein the similarity distance is computed by performing a match between at least one of:

the first item comprising a display name associated with the electronic communication and the second item comprising a display name of the authoritative entity,

the first item comprising an email address of a sender of the electronic communication and the second item comprising an email address of the authoritative entity,

the first item comprising at least a part of a text comprising the electronic communication and the second item comprising at least a part of a text associated with the authoritative entity, and

the first item comprising a header associated with the electronic communication and the second item comprising a header associated with the authoritative entity,

wherein the match is determined by at least one of:

determining that the first item and the second item are the same, determining that the first item and the second item have a Hamming distance below a first threshold value, determining that the first item and the second item have an edit distance below a second threshold value, determining that a support vector machine indicates a similarity between the first item and the second item based on previously trained examples, determining a similarity score based on how many characters in the second item were replaced by characters in the first item and performing at least one normalization prior to performing the match;

determining, by the at least one classifier component, that the electronic communication was not transmitted with an authorization from the authoritative entity; and

based at least in part on determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity and determining that the electronic communication was not transmitted with the authorization from the authoritative entity, performing a security action by the at least one server comprising at least one of: erasing the electronic communication, marking up the electronic communication at least in part by adding a warning or an explanation, flagging the electronic communication, forwarding the electronic communication to a third party, placing the electronic communications in a spam folder, and forwarding the electronic communication to a repository.

15. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions executed by at least one server for detecting attempted deception in an electronic communication, the computer instructions for:

receiving the electronic communication addressed to a user of a client device;

determining, by at least one classifier component executing on the at least one server, that the electronic communication appears to have been transmitted on behalf of an authoritative entity by:

computing a similarity distance between a first item of the electronic communication and a second item associated with the authoritative entity, wherein the second item associated with the authoritative entity is retrieved from at least one of a profile and content database, and wherein the similarity distance is computed by performing a match between at least one of:

the first item comprising a display name of the electronic communication and the second item comprising a display name of the authoritative entity,

the first item comprising an email address of a sender of the electronic communication and the second item comprising an email address of the authoritative entity,

the first item comprising at least a part of a text comprising the electronic communication and the second item comprising at least a part of a text associated with the authoritative entity, and

the first item comprising a header associated with the electronic communication and the second item comprising a header associated with the authoritative entity,

wherein the match is determined by at least one of:

determining that the first item and the second item are the same, determining that the first item and the second item have a Hamming distance below a first threshold value, determining that the first item and the second item have an edit distance below a second threshold value, determining that a support vector machine indicates a similarity between the first item and the second item based on previously trained examples, determining a similarity score based on how many characters in the second item were replaced by characters in the first item and performing at least one normalization prior to performing the match;

determining, by the at least one classifier component, that the electronic communication was not transmitted with an authorization from the authoritative entity; and

based at least in part on determining that the electronic communication appears to have been transmitted on behalf of the authoritative entity and determining that the electronic communication was not transmitted with the authorization from the authoritative entity, performing a security action comprising at least one of: erasing the electronic communication, marking up the electronic communication at least in part by adding a warning or an explanation, flagging the electronic communication, forwarding the electronic communication to a third party, placing the electronic communications in a spam folder, and forwarding the electronic communication to a repository.