1. A signature generator to create signatures identifying malicious network traffic, the signature generator comprising: a network connection for receiving malicious data from a network; a cluster analyzer for grouping the malicious data received from the network connection into similar clusters; and a signature extractor operating on at least one cluster to extracting a signature representative of the malicious data of the cluster.