10. A computer-implemented method of determining botnets, comprising: configuring at least one processor to perform the functions of: receiving, at an email server, email data being representative of a plurality of email sending features of a plurality of hosts operating within the botnets; applying a model to a plurality of elements within the email data as received at the email server; scoring each element within the model; comparing a number of outliers in the model to a threshold; grouping the hosts into a cluster based on the comparison of the number of outliers to the threshold; using the cluster to characterize botnet activities, the characterizing comprising: determining that a set of botnets belongs to a set of hosts in the cluster; determining a total number of botnets that share a sending pattern; and using the sending pattern to determine a similarity of sending patterns across botnets.
10. A computer-implemented method of determining botnets, comprising: configuring at least one processor to perform the functions of: receiving, at an email server, email data being representative of a plurality of email sending features of a plurality of hosts operating within the botnets; applying a model to a plurality of elements within the email data as received at the email server; scoring each element within the model; comparing a number of outliers in the model to a threshold; grouping the hosts into a cluster based on the comparison of the number of outliers to the threshold; using the cluster to characterize botnet activities, the characterizing comprising: determining that a set of botnets belongs to a set of hosts in the cluster; determining a total number of botnets that share a sending pattern; and using the sending pattern to determine a similarity of sending patterns across botnets. 11. The computer-implemented method of claim 10 , further comprising: grouping a plurality of botnet clusters into a plurality of superclusters based on an estimated mean of a covariance matrix determined as part of the model.