18. The method of claim 15 , further comprising: determining document features associated with each document of the plurality of documents, where generating the rules includes: generating the rules, for the model, further based on the document features associated with each document of the plurality of documents.
18. The method of claim 15 , further comprising: determining document features associated with each document of the plurality of documents, where generating the rules includes: generating the rules, for the model, further based on the document features associated with each document of the plurality of documents. 19. The method of claim 18 , where the document features associated with at least one document, of the plurality of documents, include one or more of: a file type associated with the at least one document, information identifying a host or a domain associated with the at least one document, or information associated with a length of the at least one document, where generating the rules includes: generating the rules, for the model, further based on the one or more of the file type associated with the at least one document, the information identifying the host or the domain associated with the at least one document, or the information associated with the length of the at least one document.