1. A method for classifying an executable attachment in an email received at an email processing application of a computer system comprising: a) at the email processing application, filtering said executable attachment from said email; b) extracting a byte sequence feature from said executable attachment; and c) classifying said executable attachment by comparing said byte sequence feature of said executable attachment with a classification rule set derived from byte sequence features of a set of executables having a predetermined class in a set of classes.