1. A method comprising: directing a comparison of patterns within sample code to a predetermined set of malicious software patterns; determining whether the sample code is likely to be malicious software based on the comparison; and in response to a determination that the sample code is likely to be malicious software, determining a malicious software cluster with which the sample code is associated based on the patterns within the sample code.