Patent ID: 8291024

Claim:
A method of handling a plurality of e-mail messages, the method comprising: receiving a plurality of e-mail messages at a device within a computer network; grouping the received e-mail messages into clusters, wherein e-mail messages in each cluster share a common trait, wherein the grouping includes parsing bodies of the received e-mail messages to extract traits and applying the extracted traits to group emails having common traits; and after the received e-mail messages have all been grouped, for at least one of the clusters, examining the sender domain of all e-mail messages in the cluster and assigning a first rating to the cluster based on the similarity of the sender domains of e-mail messages within the cluster; examining the subjects of all e-mail messages in the cluster and assigning a second rating to the cluster based on the similarity of the subjects of e-mail messages within the cluster; examining source network addresses of all e-mail messages in the cluster and assigning a third rating to the cluster based on the similarity of source network addresses of e-mail messages within the cluster; examining links embedded in all the e-mail messages in the cluster and assigning a fourth rating to the cluster based on the similarity of embedded links in the e-mail messages in the cluster; combining the first, second, third, and fourth ratings into a spam rating for the cluster; and performing specialized spam handling of all e-mail messages in the cluster if the spam rating exceeds a predefined threshold.