Mitigating communication risk by verifying a sender of a message
A first risk analysis of a message is performed. In the event the first risk analysis results in a determination that the message meets a first criteria, at least a portion of the message is modified prior to sending a modified version of the message to a specified recipient of the message, and a second risk analysis of the message is performed. The first risk analysis is performed before sending the modified version of the message and the modified version of the message is sent to the specified recipient of the message prior to a conclusion of the second risk analysis. In the event the second risk analysis results in a determination that the message meets a second criteria, content of the message that was previously prevented from being accessed by the specified recipient is provided to the specified recipient of the message.
1. A method, comprising:
determining a long term measure of reputation associated with a sender account of an email message;
determining a recent short term measure of reputation associated with the sender account of the email message, the recent short term measure of reputation being separate from the long term measure of reputation; and
filtering the email message based on a comparison of the determined long term measure of reputation with a first threshold associated with the sender account of the email message and a comparison of the determined short term measure of reputation with a second threshold associated with the sender account of the email message, wherein a time window associated with the long term measure of reputation is longer than a time window associated with the recent short term measure of reputation,
wherein, when the long term measure of reputation is less than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by blocking the email message from being sent to a recipient account of the email message, and
wherein, when the long term measure of reputation is greater than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by modifying the email message with a warning and delivering the modified email message to the recipient account of the email message.
2. The method of claim 1 , wherein the long term measure of reputation associated with the sender account is based on an amount of historical traffic between the sender account and the recipient account of the email message.
3. The method of claim 1 , wherein the long term measure of reputation associated with the sender account is based on an open rate for email messages sent to the recipient account of the email message.
4. The method of claim 1 , wherein the long term measure of reputation associated with the sender account is based on a response rate for email messages sent to the recipient account of the email message.
5. The method of claim 1 , wherein the long term measure of reputation associated with the sender account is based on whether a portion of traffic sent by the sender account is flagged as undesirable.
6. The method of claim 1 , wherein the short term measure of reputation associated with the sender account is based on an amount of historical traffic between the sender account and the recipient account of the email message.
7. The method of claim 1 , wherein the short term measure of reputation associated with the sender account is based on an open rate for email messages sent to the recipient account of the email message.
8. The method of claim 1 , wherein the short term measure of reputation associated with the sender account is based on a response rate for email messages sent to the recipient account of the email message.
9. The method of claim 1 , wherein the short term measure of reputation associated with the sender account is based on whether a portion of traffic sent by the sender account is flagged as undesirable.
10. The method of claim 9 , wherein the portion of traffic sent by the sender account is flagged as undesirable based in part on whether the traffic includes unwanted attachments.
11. The method of claim 9 , wherein the portion of traffic sent by the sender account is flagged as undesirable based in part on whether the traffic includes unwanted URLs.
12. The method of claim 9 , wherein the portion of traffic sent by the sender account is flagged as undesirable based in part on whether the traffic is flagged as spam.
13. The method of claim 1 , wherein the email message is filtered in part by having an administrator review the email message prior to the email message being sent to the recipient account of the email message.
14. The method of claim 1 , wherein, the email message is filtered by requiring an action by the sender account prior to allowing delivery of the email message.
15. A system, comprising:
a processor configured to:
determine a long term measure of reputation associated with a sender account of an email message;
determine a recent short term measure of reputation associated with the sender account of the email message, the recent short term measure of reputation being separate from the long term measure of reputation; and
filter the email message based on a comparison of the determined long term measure of reputation with a first threshold associated with the sender account of the email message and a comparison of the determined short term measure of reputation with a second threshold associated with the sender account of the email message, wherein a time window associated with the long term measure of reputation is longer than a time window associated with the recent short term measure of reputation
wherein, when the long term measure of reputation is less than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by blocking the email message from being sent to a recipient account of the email message, and
wherein, when the long term measure of reputation is greater than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by modifying the email message with a warning and delivering the modified email message to the recipient account of the email message; and
a memory coupled to the processor and configured to provide the processor with instructions.
16. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
determining a long term measure of reputation associated with a sender account of an email message;
determining a recent short term measure of reputation associated with the sender account of the email message, the recent short term measure of reputation being separate from the long term measure of reputation; and
filtering the email message based on a comparison of the determined long term measure of reputation with a first threshold associated with the sender account of the email message and a comparison of the determined short term measure of reputation with a second threshold associated with the sender account of the email message, wherein a time window associated with the long term measure of reputation is longer than a time window associated with the recent short term measure of reputation,
wherein, when the long term measure of reputation is less than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by blocking the email message from being sent to a recipient account of the email message, and
wherein, when the long term measure of reputation is greater than the first threshold and the short term measure of reputation is less than the second threshold, the email message is filtered by modifying the email message with a warning and delivering the modified email message to the recipient account of the email message.