Anti-spam profile clustering based on user behavior

1. A method of detecting spam in incoming emails, the method comprising:

defining a plurality of filtering profiles for application to incoming email messages, wherein each filtering profile in the plurality of filtering profiles is configured to filter the incoming email messages according to a different set of filtering rules;

assigning a first filtering profile from the plurality of filtering profiles to a user;

applying rules of the set of filtering rules of the first filtering profile to the incoming email messages;

delivering the incoming email messages to the user based on the application of the rules;

tracking actions performed by the user on two or more of the incoming email messages;

using the tracked actions to determine a first performance score;

wherein the first performance score indicates how accurately the first filtering profile is filtering incoming email messages of the user;

wherein tracking the actions performed by the user on the two or more of the incoming email messages includes at least

tracking a first set of actions of a first type performed by the user on one or more of the incoming email messages, and

tracking a second set of actions of a second type performed by the user on one or more other of the incoming email messages;

wherein the first type is different than the second type;

wherein both the first set of actions and the second set of actions include only actions that indicate that the first filtering profile incorrectly filtered email messages that should not have been filtered;

in response to determining that the user performed an action that belongs to the first set of actions and that indicates that the first filtering profile incorrectly filtered an email message that should not have been filtered, affecting the first performance score by a first amount;

in response to determining that the user performed an action that belongs to the second set of actions and that indicates that the first filtering profile incorrectly filtered an email message that should not have been filtered, affecting the first performance score by a second amount;

wherein the first amount is different than the second amount;

assigning a second filtering profile from the plurality of filtering profiles to the user based at least in part on the first performance score as affected by at least one of the first amount or the second amount;

wherein the method is performed by one or more computing devices.

2. The method of claim 1 , further comprising:

tracking actions performed by the user on the two or more of the incoming email messages to determine performance scores for all filtering profiles in the plurality of filtering profiles; and

wherein the second filtering profile has the best performance score of the plurality of filtering profiles;

wherein the step of assigning is based at least in part on a comparison of the first performance score to a second performance score that indicates how accurately the second filtering profile would have filtered the incoming email messages.

3. The method of claim 1 , wherein the filtering rules include aggregating rules and categorical rules, and wherein the tracking actions is performed by a plug-in installed on an email client.

4. The method of claim 1 , wherein the tracking actions is performed at least in part by embedding a header in a particular email message, wherein the header of the particular email message contains a unique identifier, and wherein the unique identifier is received with information about a particular action performed by the user on the particular email message.

5. The method of claim 1 , further comprising:

maintaining a first performance index concurrently with the first performance score, wherein the first performance index applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering incoming email messages of a set of users that includes the user and one or more additional users; and

in response to the first performance index being less than a particular index value, performing a remedial action that is different than assigning the second filtering profile from the plurality of filtering profiles to the user.

6. The method of claim 5 , wherein the remedial action is sending a notification to a system administrator.

7. The method of claim 5 , wherein the first performance index is determined based on one or more of: a user retention rate of the first filtering profile, a number of users joining the first filtering profile, or a number of users leaving the first filtering profile.

8. A non-transitory computer-readable storage medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

defining a plurality of filtering profiles for application to incoming email messages, wherein each filtering profile in the plurality of filtering profiles is configured to filter the incoming email messages according to a different set of filtering rules;

assigning a first filtering profile from the plurality of filtering profiles to a user;

applying rules of the set of filtering rules of the first filtering profile to the incoming email messages;

delivering the incoming email messages based on the application of the rules;

tracking actions performed by the user on two or more of the incoming email messages;

using the tracked actions to determine a first performance score, the first performance score;

wherein the first performance score indicates how accurately the first filtering profile is filtering incoming email messages of the user;

wherein tracking the actions performed by the user on the two or more of the incoming email messages includes at least

tracking a first set of actions of a first type performed by the user on one or more of the incoming email messages, and

tracking a second set of actions of a second type performed by the user on one or more other of the incoming email messages,

wherein the first type is different than the second type;

wherein both the first set of actions and the second set of actions include only actions that indicate that the first filtering profile incorrectly filtered email messages that should not have been filtered;

in response to determining that the user performed an action that belongs to the first set of actions and that indicates that the first filtering profile incorrectly filtered an email message that should not have been filtered, affecting the first performance score by a first amount;

in response to determining that the user performed an action that belongs to the second set of actions and that indicates that the first filtering profile incorrectly filtered an email message that should not have been filtered, affecting the first performance score by a second amount;

wherein the first amount is different than the second amount;

assigning a second filtering profile from the plurality of filtering profiles to the user based at least in part on the first performance score as affected by at least one of the first amount or the second amount.

9. The non-transitory computer-readable storage medium of claim 8 storing additional instructions, wherein execution of the additional instructions by the one or more processors causes the processors to perform the additional steps of:

tracking actions performed by the user on the two or more of the incoming email messages to determine performance scores for all filtering profiles in the plurality of filtering profiles; and

wherein the second filtering profile has a better performance score than other filtering profiles;

wherein the step of assigning is based at least in part on a comparison of the first performance score to a second performance score that indicates how accurately the second filtering profile would have filtered the incoming mail messages.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the filtering rules include aggregating rules and categorical rules, and wherein the tracking actions is performed by a plug-in installed on an email client.

11. The non-transitory computer-readable storage medium of claim 8 , wherein the tracking actions is performed at least in part by embedding a header in a particular email message, wherein the header of the particular email message contains a unique identifier, and wherein the unique identifier is received with information about a particular action performed by the user on the particular email message.

12. The non-transitory computer-readable storage medium of claim 8 storing additional instructions, wherein execution of the additional instructions by the one or more processors causes the processors to perform the additional steps of:

maintaining a first performance index concurrently with the first performance score, wherein the first performance index applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering incoming email messages of a set of users that includes the user and one or more additional users; and

in response to the first performance index being less than a particular index value, performing a remedial action that is different than assigning the second filtering profile from the plurality of filtering profiles to the user.

13. The non-transitory computer-readable storage medium of claim 12 , wherein the remedial action is sending a notification to a system administrator.

14. The non-transitory computer-readable storage medium of claim 12 , wherein the first performance index is determined based on one or more of: a user retention rate of the first filtering profile, a number of users joining the first filtering profile, or a number of users leaving the first filtering profile.

15. A method of tracking a performance of a filtering profile using a filtering system, the method comprising:

defining a first filtering profile to be applied to incoming email messages of a user, wherein the first filtering profile filters the incoming email messages of the user according to a set of filtering rules;

based at least in part on actions performed on the incoming email messages of the user, determining how accurately the first filtering profile is filtering the incoming email messages of only the user;

based at least in part on actions performed on incoming email messages of a set of users that includes the user and one or more additional users, determining how accurately the first filtering profile is filtering the incoming email messages of the set of users;

maintaining, by the filtering system, both: (a) a first performance score that applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering the incoming email messages of only the user, and (b) a first performance index that applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering the incoming email messages of the set of users;

comparing the first performance score to a particular score value;

the filtering system performing a first type of action on the first filtering profile in response to the first performance score being less than the particular score value; and

comparing the first performance index to a particular index value;

the filtering system performing a second type of action on the first filtering profile in response to the first performance index being less than the particular index value;

wherein the first type of action is different than the second type of action;

wherein the method is performed by one or more computing devices.

16. The method of claim 15 , wherein the first type of action is assigning a different filtering profile to the user, and the second type of action is sending a notification to a system administrator.

17. The method of claim 15 , wherein maintaining the first performance index includes recording a number of users who have been added to the first filtering profile.

18. The method of claim 15 , wherein maintaining the first performance index includes recording a number of users who have been removed from the first filtering profile.

19. The method of claim 15 , wherein maintaining the first performance index includes determining a user retention rate for the first filtering profile.

20. The method of claim 1 , wherein the first filtering profile filters the two or more of the incoming email messages as spam, wherein the first set of actions consists of actions performed by the user to affirmatively identify the one or more of the incoming email messages as not spam, and wherein the second set of actions consists of actions performed by the user that infer that the one or more other of the incoming email messages are not spam.

21. The method of claim 1 , wherein the first set of actions consists of actions that occurred more recently than actions in the second set of actions.

22. The method of claim 5 , wherein the second type of action comprises freezing the first filtering profile such that users can no longer be assigned to the first filtering profile.

23. The non-transitory computer-readable storage medium of claim 8 , wherein the first filtering profile filters the two or more of the incoming email messages as spam, wherein the first set of actions consists of actions performed by the user to affirmatively identify the one or more of the incoming email messages as not spam, and wherein the second set of actions consists of actions performed by the user that infer that the one or more other of the incoming email messages are not spam.

24. The non-transitory computer-readable storage medium of claim 8 , wherein the first set of actions consists of actions that occurred more recently than actions in the second set of actions.

25. One or more non-transitory computer-readable media storing instructions for tracking a performance of a filtering profile using a filtering system, wherein the instructions, when executed by one or more processors, cause:

defining a first filtering profile to be applied to incoming email messages of a user, wherein the first filtering profile filters the incoming email messages of the user according to a set of filtering rules;

based at least in part on actions performed on the incoming email messages of the user, determining how accurately the first filtering profile is filtering the incoming email messages of only the user;

based at least in part on actions performed on incoming email messages of a set of users that includes the user and one or more additional users, determining how accurately the first filtering profile is filtering the incoming email messages of the set of users;

maintaining, by the filtering system, both: (a) a first performance score that applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering the incoming email messages of only the user, and (b) a first performance index that applies to only the first filtering profile and indicates how accurately the first filtering profile is filtering the incoming email messages of the set of users;

comparing the first performance score to a particular score value;

performing, by the filtering system, a first type of action on the first filtering profile in response to the first performance score being less than the particular score value; and comparing the first performance index to a particular index value;

performing, the filtering system, a second type of action on the first filtering profile in response to the first performance index being less than the particular index value;

wherein the first type of action is different than the second type of action;

wherein the method is performed by one or more computing devices.

26. The method of claim 15 , wherein the second type of action comprises freezing the first filtering profile such that no user can be assigned to the first filtering profile.

27. The non-transitory computer-readable storage medium of claim 25 , wherein the second type of action comprises freezing the first filtering profile such that no user can be assigned to the first filtering profile.

28. The one or more non-transitory computer-readable media of claim 25 , wherein the first type of action is assigning a different filtering profile to the user, and the second type of action is sending a notification to a system administrator.

29. The one or more non-transitory computer-readable media of claim 25 , wherein maintaining the first performance index includes recording a number of users who have been added to the first filtering profile.

30. The one or more non-transitory computer-readable media of claim 25 , wherein maintaining the first performance index includes recording a number of users who have been removed from the first filtering profile.

31. The one or more non-transitory computer-readable media of claim 25 , wherein maintaining the first performance index includes determining a user retention rate for the first filtering profile.