11. A networking device for detecting a network activity of interest, comprising: a network port for connecting to a network infrastructure, wherein the network port is adapted to obtain a plurality of network packets, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include the network activity of interest; a processor connected to the network port, wherein the processor is adapted to: create a plurality of combined packets, from at least a subset of the plurality of TCP packets and IP packets, wherein: a first combined packet of the plurality of combined packets comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets, and a second combined packet of the plurality of combined packets comprises a portion of at least one of the TCP packets and a portion of at least one of the IP packets, wherein the second combined packet is different from the first combined packet; create a first sequence by converting bitwise content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; create a second sequence by converting bitwise content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determine a similarity metric between the first sequence and the second sequence based on a distance function; create a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in the first order; and create a fourth sequence, wherein the fourth sequence is a meta-expression that: comprises a subset of the third plurality of integers of the third list, in the first order, and corresponds to the presence of the network activity of interest in the network traffic; and a memory connected to the processor, wherein the memory is adapted to store the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest.
18. The networking device of claim 11 , wherein: the converting bitwise content of the at least a portion of the first combined packets into the first plurality of integers comprises grouping the bitwise content of the at least a portion of the first combined packet into 8-bit integers.