A method and a system are provided for generating a representative sub-signature of a particular cluster of signatures. In one example, the system reads a sub-signature of a signature of the particular cluster. The system calculates a first factor for the sub-signature. The first factor is based on how many signatures contain the sub-signature. The signatures are in the particular cluster. The system calculates a second factor for the sub-signature. The second factor is based on how many signatures in other clusters contain the sub-signature. These other signatures in other clusters are not in the particular cluster. The system calculates an effectiveness score for the sub-signature. The effectiveness score is based on at least the first factor and the second factor. The system then determines one or more representative sub-signatures for the particular cluster. The one or more sub-signatures are based on one or more effectiveness scores calculated by the system.