26. A non-transitory computer-readable storage medium having computer-executable instructions which, when executed by one or more computer processors, causes the one or more computer processors to detect a network activity of interest, the computer-executable instructions comprising instructions for: (a) obtaining a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include the network activity of interest; (b) creating a combined packet from at least two network packets of the plurality of network packets, wherein creating the combined packet comprises converting, bitwise, content from a portion of a first network packet and a portion of a second network packet into a plurality of integers, wherein the first network packet represents a communication from a first node to a second node, and wherein the second network packet represents a communication from the second node to the first node; (c) obtaining a meta-expression that: comprises a plurality of integers in an order, and corresponds to presence of the network activity of interest in network traffic; determining whether the meta-expression obtained in (c) appears in the combined packet created in (b); and initiating an operation based in response to determining that the meta-expressions obtained in (c) appears in the combined packet created in (b).
26. A non-transitory computer-readable storage medium having computer-executable instructions which, when executed by one or more computer processors, causes the one or more computer processors to detect a network activity of interest, the computer-executable instructions comprising instructions for: (a) obtaining a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include the network activity of interest; (b) creating a combined packet from at least two network packets of the plurality of network packets, wherein creating the combined packet comprises converting, bitwise, content from a portion of a first network packet and a portion of a second network packet into a plurality of integers, wherein the first network packet represents a communication from a first node to a second node, and wherein the second network packet represents a communication from the second node to the first node; (c) obtaining a meta-expression that: comprises a plurality of integers in an order, and corresponds to presence of the network activity of interest in network traffic; determining whether the meta-expression obtained in (c) appears in the combined packet created in (b); and initiating an operation based in response to determining that the meta-expressions obtained in (c) appears in the combined packet created in (b). 30. The non-transitory computer-readable medium of claim 26 , wherein the network activity of interest is an attack using a computer virus.