Abstract: A hosted service monitoring system detects abuse of a hosted service by monitoring user actions over a period of time. The system will identify an entity, which is a subset of the user actions that share one or more features in common. The system will also identify feature statistics to measure how often the features are associated with the user actions in the entity. The system will project the feature statistics to a vector and use the vector to generate an anomaly score for the entity. The system will determine that the entity is associated with an automated initiator if it generates an anomaly score that exceeds a threshold. Upon determining that the entity that is associated with an automated initiator, the system will cause the hosted service to take an action that will block the automated initiator from accessing the hosted service.

Abstract: Systems and methods are provided for organizing messages. A plurality of messages is communicated to a user with a designation of the message category of each respective message in the plurality of messages. The plurality of messages includes, for each respective message category in a plurality of message categories, at least one message in the respective message category. A user selection of a first message in the plurality of messages is received, whereupon a subset of the plurality of messages similar to the first message is selected based upon respective comparisons of continuous vector representations of (i) a set of words in the first message and (ii) a corresponding set of words in messages in the subset of messages. An identification of each respective message in the subset of messages is then displayed.

Abstract: Systems and methods are provided for organizing messages. A plurality of messages is communicated to a user with a designation of the message category of each respective message in the plurality of messages. The plurality of messages includes, for each respective message category in a plurality of message categories, at least one message in the respective message category. A user selection of a first message in the plurality of messages is received, whereupon a subset of the plurality of messages similar to the first message is selected based upon respective comparisons of continuous vector representations of (i) a set of words in the first message and (ii) a corresponding set of words in messages in the subset of messages. An identification of each respective message in the subset of messages is then displayed.