1. A method comprising: directing a comparison of patterns within sample code to a predetermined set of malicious software patterns, wherein determining the predetermined set of malicious software patterns comprises: determining common patterns between known malicious software samples based on frequently occurring symbol combinations; and filtering the common patterns based on patterns of known benign software samples to define the predetermined set of malicious software patterns; determining that the sample code is malicious software based on a number of patterns within the sample code that match patterns within the predetermined set of malicious software patterns; and subsequent to the determination that the sample code is malicious software, determining one or more clusters with which the sample code is associated, wherein the determination of the one or more clusters with which the sample code is associated with comprises: determining a first occurrence frequency, the first occurrence frequency being a number of distinct malicious software samples that match each malware code pattern within the sample code; determining a second occurrence frequency, the second occurrence frequency being a number of distinct malicious software samples that match each malware code pattern within a subset of the sample code; determining a first malicious software cluster with which the sample code is associated based on the first occurrence frequency, wherein the first malicious software cluster is comprised of one or more malicious software samples clustered based on a set of malicious code patterns to which the one or more malicious software samples matches; and determining a second malicious software cluster with which the sample code is associated based on the difference between the first occurrence frequency and the second occurrence frequency being less than or equal to a predetermined parameter, wherein the second malicious software cluster is comprised of one or more malicious software samples clustered based on the set of malicious code patterns to which the one or more malicious software samples matches; and providing an output, in response to a request comprising the sample code, indicating that the sample code is malicious software.