A method is provided for generating regular expressions. In some embodiments, the method includes partitioning a first plurality of text strings into a plurality of substrings, each text string of the first plurality being malignant or benign. The method also includes generating a population list including a second plurality of text strings, each text string of the second plurality including at least one token. The method further includes creating subsequent iterations of the population list. Each iteration may include calculating a score for one or more text strings in the population list and removing one or more text strings from the population list. The method further includes in response to a determination to not update the population list, selecting, based on the one or more calculated scores, a third text string as a regular expression from a final iteration of the population list.