17. A non-transitory computer-readable storage medium having computer-executable instructions for detecting a network activity of interest, computer-executable instructions comprising instructions for: obtaining a plurality of network packets from a network, wherein the obtained plurality of network packets includes the network activity of interest; creating a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; creating, by the one or more processors, a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining a similarity metric between the first sequence and the second sequence based on a distance function; creating a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and storing the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest.
18. The non-transitory computer-readable medium of claim 17 , wherein: the network activity of interest is a threat based on a computer virus.