1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to: populate strings extracted from clean samples into a clean string database; populate strings extracted from dirty samples into a dirty string database; determine a string sample of data; determine a hash of the string sample of data; perform an Internet search for the string sample; compare the results of the Internet search for the string sample with results of an Internet search for known clean string samples; not cluster the hash of the string sample of data if the number of hits from the Internet search is comparable to the number of hits from a known clean string sample search; cluster the hash with other hashes from other string samples of data to create a string hash signature of a string sample of data if the number of hits from the Internet search is not comparable to the number of hits from a known clean string sample search; and filter the hash of the string sample of data using the clean string database and not cluster the hash of the string sample of data with the other hashes if the hash of the string sample of data is found in the clean string database.