9. A networking device for detecting a network activity of interest, comprising: a network port for connecting to a network infrastructure, wherein the network port is adapted to obtain a plurality of network packets, wherein the obtained plurality of network packets includes the network activity of interest; a processor connected to the network port, wherein the processor is adapted to: create a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; create a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; create a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determine a similarity metric between the first sequence and the second sequence based on a distance function; create a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and a memory connected to the processor, wherein the memory is adapted to store the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest.
9. A networking device for detecting a network activity of interest, comprising: a network port for connecting to a network infrastructure, wherein the network port is adapted to obtain a plurality of network packets, wherein the obtained plurality of network packets includes the network activity of interest; a processor connected to the network port, wherein the processor is adapted to: create a plurality of combined packets from the plurality of network packets, wherein the plurality of combined packets includes: a first combined packet, and a second combined packet different from the first combined packet; create a first sequence by converting content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; create a second sequence by converting content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determine a similarity metric between the first sequence and the second sequence based on a distance function; create a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in a first order, wherein the third sequence is a meta-expression that corresponds to the presence of the network activity of interest in the network traffic; and a memory connected to the processor, wherein the memory is adapted to store the meta-expression, wherein the stored meta-expression is used to detect the presence of the network activity of interest. 11. The networking device of claim 9 , wherein the creating of the first combined packet comprises: identifying a first network packet, of the plurality of network packets, representing a request; identifying a second network packet, of the plurality of network packets, representing an acknowledgement, wherein the second network packet: occurs after the first network packet, and represents an acknowledgement corresponding to the first network packet; and identifying a third network packet of the plurality of network packets, wherein the third network packet occurs between the first network packet and the second network packet.