1. A computer-implemented method for detecting a network activity of interest, the method comprising: obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets includes the network activity of interest; creating, by the one or more processors, a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; creating, by the one or more processors, a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining, by the one or more processors, a similarity metric between the first sequence and the second sequence based on a distance function; creating, by the one or more processors, a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and storing the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest.