| CPC H04L 63/145 (2013.01) [H04L 51/212 (2022.05); H04L 63/1416 (2013.01)] | 20 Claims |

|
1. A method, comprising:
accessing, by a computer system, an email addressed to an email address of an email system, wherein the email address is for a user of the email system;
performing, by the computer system, a discrete analysis of the email to determine behavior of the user, wherein the discrete analysis includes determining whether the email relates to use, by the user, of an Internet service established with the email address;
updating, based on the discrete analysis, a data store that stores indications of Internet service activity of users of the email system;
determining, based on the discrete analysis, whether a corrective action for the email is to be taken;
performing, by the computer system, an aggregate analysis of behavior of multiple users of the email system, wherein the aggregate analysis includes identification of an aggregate set of Internet services for a group of users and the aggregate analysis takes into account the determined behavior of the user indicated by the discrete analysis of the email; and
updating the data store based on the aggregate analysis.
|