Abstract: One or more computing devices, systems, and/or methods for message classification are provided. For example, a set of messages is clustered into a set of clusters. A cluster comprises messages with similar features (e.g., similar subject lines, message body content, sender information, recipient information, structure, user action such as reading or deleting, spam vote information, etc.). Cluster features are computed for the clusters based upon features of messages within such clusters. A first table, comprising cluster entries corresponding cluster features of clusters, and a second table, comprising message entries corresponding to clusters to which messages are assigned, are created. Message features of a message are created, using the first table and second table, based upon features of the message and cluster features of clusters to which the message is assigned. A message classifier is used to classify the message (e.g., spam, safe, a threat, etc.) based upon the message features.

Abstract: Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.

Abstract: One or more computing devices, systems, and/or methods for message classification are provided. For example, a set of messages is clustered into a set of clusters. A cluster comprises messages with similar features (e.g., similar subject lines, message body content, sender information, recipient information, structure, user action such as reading or deleting, spam vote information, etc.). Cluster features are computed for the clusters based upon features of messages within such clusters. A first table, comprising cluster entries corresponding cluster features of clusters, and a second table, comprising message entries corresponding to clusters to which messages are assigned, are created. Message features of a message are created, using the first table and second table, based upon features of the message and cluster features of clusters to which the message is assigned. A message classifier is used to classify the message (e.g., spam, safe, a threat, etc.) based upon the message features.

Abstract: Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.

Abstract: Embodiments are directed towards multi-level entity classification. An object associated with an entity is received. In one embodiment the object comprises and email and the entity comprises the IP address of a sending email server. If the entity has already been classified, as indicated by an entity classification cache, then a corresponding action is taken on the object. However, if the entity has not been classified, the entity is submitted to a fast classifier for classification. A feature collector concurrently fetches available features, including fast features and full features. The fast classifier classifies the entity based on the fast features, storing the result in the entity classification cache. Subsequent objects associated with the entity are processed based on the cached result of the fast classifier. Then, a full classifier classifies the entity based on at least the full features, storing the result in the entity classification cache.

Abstract: A method of determining popularity of an e-mail is provided. The method includes receiving an e-mail and determining if a generated signature is associated with the e-mail. If there is no generated signature, then a signature is generated for associating with the e-mail. A popularity measure associated with the e-mail is determined based on the signature. Furthermore, a method of determining popularity of an e-mail is provided. The method includes receiving an e-mail and identifying a generated signature associated with the e-mail. The method further includes determining a match of the associated generated signature with a record of the generated signature, if the generated signature is identified. If the identified generated signature is determined to match the record of the generated signature, then a popularity measure associated with the e-mail is increased.

Abstract: A method of determining popularity of an e-mail is provided. The method includes receiving an e-mail and determining if a generated signature is associated with the e-mail. If there is no generated signature, then a signature is generated for associating with the e-mail. A popularity measure associated with the e-mail is determined based on the signature. Furthermore, a method of determining popularity of an e-mail is provided. The method includes receiving an e-mail and identifying a generated signature associated with the e-mail. The method further includes determining a match of the associated generated signature with a record of the generated signature, if the generated signature is identified. If the identified generated signature is determined to match the record of the generated signature, then a popularity measure associated with the e-mail is increased.

Abstract: Disclosed are apparatus and methods for processing an electronic statement. In one embodiment, an electronic mail message addressed to an electronic mail address is received, the electronic mail message including bill information associated with a bill, where the bill information indicates a bill amount, a due date of the bill, a sender of the bill, and an addressee of the bill. A set of user preferences is obtained, and the bill information is processed according to the set of user preferences.