12. A system for identifying malicious queries, comprising: a storage server that stores a plurality of search logs, the search logs including records each containing a query, a time at which the query was issued, a set of results returned, a user agent, and an IP (Internet protocol) address that issued the query; a proxy filter that profiles behaviors associated with the IP address to determine if the IP address is associated with a proxy; and a regular expression generator that generates regular expressions that are applied to the search logs, wherein a set of seed malicious queries are input to the storage server to extract the IP address from the search logs that submitted a query that matches one of the set of seed malicious queries to create an expanded query set that is used by the regular expression generator to generate the regular expressions, and wherein the regular expressions are applied to the search logs to output an enlarged set of malicious queries.
12. A system for identifying malicious queries, comprising: a storage server that stores a plurality of search logs, the search logs including records each containing a query, a time at which the query was issued, a set of results returned, a user agent, and an IP (Internet protocol) address that issued the query; a proxy filter that profiles behaviors associated with the IP address to determine if the IP address is associated with a proxy; and a regular expression generator that generates regular expressions that are applied to the search logs, wherein a set of seed malicious queries are input to the storage server to extract the IP address from the search logs that submitted a query that matches one of the set of seed malicious queries to create an expanded query set that is used by the regular expression generator to generate the regular expressions, and wherein the regular expressions are applied to the search logs to output an enlarged set of malicious queries. 14. The system of claim 12 , wherein the regular expression generator determines a score that measures the likelihood that a particular regular expression matches a random string, and wherein the regular expression generator discards the regular expressions that exceed the score.