Systems and methods for electronic message analysis

摘要

Systems and methods for analyzing electronic messages are disclosed. In some embodiments, the method comprises receiving a new received message from an indicated sender, the new received message having a first message characteristic of the indicated sender and a second message characteristic, identifying an actual sender message characteristic pattern of an actual sender using the first message characteristic, probabilistically comparing the second message characteristic to the actual sender message characteristic pattern, determining a degree of similarity of the second message characteristic to the actual sender message characteristic pattern, and influencing a probability that the indicated sender is the actual sender based upon the degree of similarity. There may be multiple message characteristics and patterns. In some embodiments, the methods may utilize pattern matching techniques, recipient background information, quality measures, threat intelligence data or URL information to help determine whether the new received message is from the actual sender.

主权项

1. A computer implemented method for analyzing electronic messages, the method comprising:
receiving a new received message from an indicated sender; the new received message having at least one first message characteristic of the indicated sender and at least one second message characteristic; identifying, with a processor, at least one actual sender message characteristic pattern of an actual sender using the at least one first message characteristic; wherein the at least one actual sender message characteristic pattern comprises at least one message characteristic label; wherein the at least one message characteristic label comprises a negative actual sender message characteristic label whereby the negative actual sender message characteristic label represents a message characteristic pattern of another sender not the actual sender; wherein the at least one message characteristic label further comprises a positive actual sender message characteristic label whereby a positive comparison of the at least one second message characteristic to the positive actual sender message characteristic label increases the probability that the indicated sender is the actual sender; probabilistically comparing, with the processor, the at least one second message characteristic to the at least one message characteristic label; determining, with the processor, a degree of similarity of the at least one second message characteristic to the at least one actual sender message characteristic pattern; and influencing, with the processor, a probability that the indicated sender is the actual sender based upon the degree of similarity.