19. The computer-implemented method of claim 16 , wherein comparing the de-obfuscated representative sample to the plurality of known malicious code samples includes: determining a winnow histogram for the de-obfuscated representative sample; and comparing the determined winnow histogram to a corresponding plurality of winnow histograms for the plurality of known malicious code samples.
16. A computer-implemented method comprising: producing a plurality of tokenized samples of script code by transforming a plurality of script code samples into the plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying a cluster of tokenized samples from the plurality of tokenized samples, a first tokenized sample in the cluster of tokenized samples having at least one similarity with each additional tokenized sample in the cluster of tokenized samples; selecting the first tokenized sample as a representative sample of the cluster; comparing the representative sample to known malicious code; based on the comparing, identifying known malicious code from among the code, the known malicious code having a threshold similarity to the representative sample by de-obfuscating the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparing the de-obfuscated representative sample to a plurality of known malicious code samples; and based on the identified known malicious code, labeling the cluster of tokenized samples as malicious, wherein the label of cluster of samples as malicious is unscored.