1. A computer-implemented method for detecting a network activity of interest, the method comprising: obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets includes the network activity of interest; creating, by the one or more processors, a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; creating, by the one or more processors, a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining, by the one or more processors, a similarity metric between the first sequence and the second sequence based on a distance function; creating, by the one or more processors, a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and storing the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest.
1. A computer-implemented method for detecting a network activity of interest, the method comprising: obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets includes the network activity of interest; creating, by the one or more processors, a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; creating, by the one or more processors, a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining, by the one or more processors, a similarity metric between the first sequence and the second sequence based on a distance function; creating, by the one or more processors, a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and storing the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest. 25. The computer-implemented method of claim 1 , wherein the one or more processors are processors of a first computing device, wherein the stored meta-expression is stored on the first computing device, and the method further comprises: detecting, by the one or more processors of the first computing device, the network activity of interest using the stored meta-expression.