A method of sample analysis, comprising: sending a set of sample splitting rules from a server to a client; receiving, at the server, a hash of a sample from the client; determining, at the server, whether the sample is available to a dictionary communicatively coupled to the server; providing, by the server, an indication to the client whether the sample is available to the server; and if the indication is that the sample is not available: receiving at the server a plurality of hashes of filtered portions of the sample, along with their respective locations relative to a beginning of the sample, wherein the filtered portions have been created by splitting the sample according to the set of rules, wherein the filtered portions comprise portions of the sample that remain after at least a part of the portion of the sample has been discarded, wherein each filtered portion remains sufficiently similar to the respective portion before filtering, thereby allowing the server to perform malware analysis on the sample, and wherein each of the plurality of hashes of filtered portions comprises a fingerprint; determining, at the server, whether each of the plurality of portions corresponding to the received plurality of hashes of filtered portions is available to the dictionary; providing, by the server, an indication to the client whether each of the plurality of portions is available to the dictionary; receiving, at the server, filtered versions of only those portions wherein the portion is not available to the dictionary; storing the received filtered portions in the dictionary; and performing malware analysis on the sample. sending a set of sample splitting rules from a server to a client; receiving, at the server, a hash of a sample from the client; determining, at the server, whether the sample is available to a dictionary communicatively coupled to the server; providing, by the server, an indication to the client whether the sample is available to the server; and if the indication is that the sample is not available: receiving at the server a plurality of hashes of filtered portions of the sample, along with their respective locations relative to a beginning of the sample, wherein the filtered portions have been created by splitting the sample according to the set of rules, wherein the filtered portions comprise portions of the sample that remain after at least a part of the portion of the sample has been discarded, wherein each filtered portion remains sufficiently similar to the respective portion before filtering, thereby allowing the server to perform malware analysis on the sample, and wherein each of the plurality of hashes of filtered portions comprises a fingerprint; determining, at the server, whether each of the plurality of portions corresponding to the received plurality of hashes of filtered portions is available to the dictionary; providing, by the server, an indication to the client whether each of the plurality of portions is available to the dictionary; receiving, at the server, filtered versions of only those portions wherein the portion is not available to the dictionary; storing the received filtered portions in the dictionary; and performing malware analysis on the sample. receiving at the server a plurality of hashes of filtered portions of the sample, along with their respective locations relative to a beginning of the sample, wherein the filtered portions have been created by splitting the sample according to the set of rules, wherein the filtered portions comprise portions of the sample that remain after at least a part of the portion of the sample has been discarded, wherein each filtered portion remains sufficiently similar to the respective portion before filtering, thereby allowing the server to perform malware analysis on the sample, and wherein each of the plurality of hashes of filtered portions comprises a fingerprint; determining, at the server, whether each of the plurality of portions corresponding to the received plurality of hashes of filtered portions is available to the dictionary; providing, by the server, an indication to the client whether each of the plurality of portions is available to the dictionary; receiving, at the server, filtered versions of only those portions wherein the portion is not available to the dictionary; storing the received filtered portions in the dictionary; and performing malware analysis on the sample.