SYSTEM AND METHOD FOR IDENTIFYING FORGED EMAILS

Forged emails are detected by extracting email address parts of a sender email address. The email address parts include an account name, a subdomain, and a base domain of the sender email address. The mutation ratio of the email address parts relative to reference strings are calculated to determine similarity of the email address parts to the reference strings. The mutation ratios are compared to ratio thresholds to identify suspicious email addresses, and the results of identifying suspicious email addresses are correlated with other computer security information to identify forged emails.