11. A system, comprising: one or more processors; memory; and one or more programming modules stored on the memory and executable by the one or more processors to: receive a plurality of code script samples; transform the plurality of code script samples into a plurality of tokenized samples, the transform based on syntactical elements of the plurality of code script samples; receive from a cluster engine identification of a cluster of samples, the cluster of samples including at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples, the cluster being identified at least in part based on similarities of the first tokenized sample and the second tokenized sample; identify the first tokenized sample as a representative sample of the cluster of samples; identify a known malicious code sample that has at least a threshold similarity to the representative sample by de-obfuscation of the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparison of the de-obfuscated representative sample to a plurality of known malicious code sample; based on the identified known malicious code, label the cluster of samples as malicious, wherein the label of cluster of samples as malicious is unscored; and generate, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature that identifies the first tokenized sample and the second tokenized sample.
11. A system, comprising: one or more processors; memory; and one or more programming modules stored on the memory and executable by the one or more processors to: receive a plurality of code script samples; transform the plurality of code script samples into a plurality of tokenized samples, the transform based on syntactical elements of the plurality of code script samples; receive from a cluster engine identification of a cluster of samples, the cluster of samples including at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples, the cluster being identified at least in part based on similarities of the first tokenized sample and the second tokenized sample; identify the first tokenized sample as a representative sample of the cluster of samples; identify a known malicious code sample that has at least a threshold similarity to the representative sample by de-obfuscation of the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparison of the de-obfuscated representative sample to a plurality of known malicious code sample; based on the identified known malicious code, label the cluster of samples as malicious, wherein the label of cluster of samples as malicious is unscored; and generate, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature that identifies the first tokenized sample and the second tokenized sample. 13. The system of claim 11 , wherein the one or more programming modules are further executable by the one or more processors to implement the cluster engine, the cluster engine configured to determine an edit distance between the first tokenized sample and the second tokenized sample to determine the one or more similarities in different ones of the plurality of tokenized samples.