Detection of external messaging attacks using trust relationships

1. A method comprising: accessing extracted header data for a plurality of prior messages, each prior message having a sender and a target; building a profile for each target within an organization, each target being a receiver of at least one prior message of the plurality of prior messages; determining a degree of communication for the plurality of prior messages for each relationship between a respective sender and a respective target of a respective prior message within the plurality of prior messages, wherein the degree of communication relates to a degree of separation of exchanged messages between the respective sender and the target; giving a numerical value to the degree of communication for each relationship between the respective sender and the respective target; determining a quantity of communication for the plurality of prior messages for each relationship between a respective sender and a respective target of a respective prior message within the plurality of prior messages, wherein the quantity of communication relates to how many messages are exchanged between the respective sender and the target; giving a numerical value to the quantity of communication for each relationship between the respective sender and the respective target; deriving a trust score for each sender of a message within the plurality of prior messages for each target profile, each trust score being derived by combining the numerical value for the degree of communication and the numerical value for the quantity of communication between the respective sender and the target in the extracted header data; receiving a plurality of incoming messages; determining a target and a sender of each of the plurality of incoming messages; retrieving the respective trust score for the sender from the profile of the target for each respective incoming message; generating labels for each of incoming message based on the respective trust score, wherein a label associated with a suspicious incoming message points to a specific portion of the suspicious incoming message that has been identified as suspicious; and applying the respective label to be visible to the target in association with the message for each respective message, wherein the generated labels provide a user insight regarding trustworthiness of the message and reasoning for the trustworthiness of the message when the user either hovers over the generated labels or selects the generated labels.

2. The method of claim 1 , wherein giving a numerical value to the degree of communication comprises giving a higher trust score for a lower degree of separation.

3. The method of claim 2 , wherein the higher trust score is derived for direct messages between the target and the sender and a lower trust score is derived for the target profile for messages between a third person and the sender.

4. The method of claim 1 , wherein the quantity of communication is determined at least in part by a number of messages as indicated in the extracted header data.

5. The method of claim 1 , wherein the quantity of communication is determined at least in part by a recency of messages as indicated in the extracted header data.

6. The method of claim 1 , wherein the quantity of communication is determined at least in part by a longevity of messages as indicated in the extracted header data.

7. The method of claim 1 , wherein each trust score is further derived from a quality of the plurality of prior messages based on whether the target is in a “To” field or another field as indicated in the extracted header data.

8. The method of claim 1 , wherein each trust score is further derived from a quality of the plurality of prior messages based on a number of other addressees of the plurality of prior messages as indicated in the extracted header data.

9. The method of claim 1 , wherein each trust score is further derived from a quality of the messages based on a number of messages within a same thread.

10. The method of claim 1 wherein receiving the plurality of incoming messages comprises receiving the messages at a remote service.

11. The method of claim 1 , further comprising generating a high trust score label for each message from a sender within the organization.

12. The method of claim 1 , further comprising updating the profiles using the received plurality of incoming messages by extracting header data and revising the respective trust scores.

13. The method of claim 1 , further comprising building a relationship graph using the extracted header data and the trust scores, the relationship graph indicating a relationship between a sender and a target based on prior messages between the sender and the target.

14. The method of claim 1 , further comprising testing the message integrity to determine whether a sending domain and path are valid and modifying the generated label based on the message integrity.

15. The method of claim 1 , further comprising disabling elements of the messages based on the trust score.

16. An apparatus comprising: a detection processor to receive extracted header data for a plurality of messages, each message having a sender and a target, to build a profile for each target within an organization, each target being a receiver of at least one of the plurality of messages, and to derive a trust score for each sender of a message within the plurality of messages for each target profile, each trust score being derived from a degree and a quantity of communication between the respective sender and the target in the extracted header data, wherein the degree of communication relates to a degree of separation of exchanged messages between the respective sender and the target, wherein the quantity of communication relates to how many messages are exchanged between the respective sender and the target, and wherein the trust score is derived by giving a numerical value to the degree of communication for each relationship between the respective sender and the respective target, giving a numerical value to the quantity of communication for each relationship between the respective sender and the respective target, and combining the respective numerical value for the degree of communication and the respective numerical value for the quantity of communication; and a database to store the extracted header data and the profiles for each target including trust scores for each sender, the detection processor further to receive a plurality of incoming messages, to determine a target and a sender of each of the plurality of incoming messages, to retrieve the respective trust score for the sender from the profile of the target for each respective message, to generate labels for each message based on the respective trust score, and to apply the respective label to be visible to the target in association with the message for each respective message, wherein the generated labels provide actionable insights associated with a reasoning for the generated labels and wherein the actionable insights provide user training, wherein the generated labels provide a user insight regarding trustworthiness of the message and reasoning for the trustworthiness of the message when the user either hovers over the generated labels or selects the generated labels.

17. The apparatus of claim 16 , further comprising:

a crowd wisdom database having records of target feedback regarding messages received by the respective target from senders and wherein the detection processor is further to scale the trust score using the crowd wisdom database.

18. A non-transitory machine-readable medium having instructions stored thereon that, when operated on by one or more processors, causes the machine to perform operations comprising:

accessing extracted header data for a plurality of prior messages, each message having a sender and a target;

building a profile for each target within an organization, each target being a receiver of at least one of the plurality of messages;

determining a degree of communication for the plurality of messages for each relationship between a respective sender and a respective target of a respective message within the plurality of messages, wherein the degree of communication relates to a degree of separation of exchanged messages between the respective sender and the target;

giving a numerical value to the degree of communication for each relationship between the respective sender and the respective target;

determining a quantity of communication for the plurality of messages for each relationship between a respective sender and a respective target of a respective message within the plurality of messages, wherein the quantity of communication relates to how many messages are exchanged between the respective sender and the target;

giving a numerical value to the quantity of communication for each relationship between the respective sender and the respective target;

deriving a trust score for each sender of a message within the plurality of messages for each target profile, each trust score being derived by combining the numerical value for the degree of communication and the numerical value for the quantity of communication between the respective sender and the target in the extracted header data;

receiving a plurality of incoming messages;

determining a target and a sender of each of the plurality of incoming messages;

retrieving the respective trust score for the sender from the profile of the target for each respective incoming message;

generating labels for each of incoming message based on the respective trust score; and

applying the respective label to be visible to the target in association with the message for each respective message, wherein the generated labels provide a user insight regarding trustworthiness of the message and reasoning for the trustworthiness of the message when the user either hovers over the generated labels or selects the generated labels.

19. The medium of claim 18 , the operations further comprising extracting the header data from the plurality of messages.