1. A computer-implemented method of generating a behavioral signature for detecting malicious software (malware) comprising: using a computer to collect behavior traces of malware in a malware dataset, the behavior traces describing sequential behaviors performed by the malware; normalizing the behavior traces for the malware to produce malware behavior sequences; clustering similar malware behavior sequences together in a cluster, wherein the malware behavior sequences in the cluster describe behaviors of a malware family; analyzing the cluster to identify a behavior subsequence common to the malware family; and creating a behavioral signature for the malware family using the behavior subsequence.