1. An apparatus comprising processing circuitry configured to execute instructions for: receiving query binary code; generating token sequence n-grams based on the query binary code; hashing the n-grams; partitioning samples by length to compare selected samples based on length; and generating an n-gram score based on a dynamic decimation of token sequence n-grams and a plurality of reference samples, wherein the n-gram score is indicative of the similarity between the selected sample and the reference samples.