Methods, systems, and computer program products for signature detection. One example of a method includes: acquiring an article defect density map comprising a plurality of sections corresponding to a first resolution level which is indicative of defect numbers for the sections, and determining a distribution representative of the defect numbers or function thereof; determining a threshold in accordance with said distribution, and identifying sections, out of said plurality of sections in the article defect density map, with defect numbers or function thereof above the threshold; and clustering at least part of adjoining identified sections, into one or more signatures, thus detecting said one or more signatures.