Spamming botnets: signatures and characteristics
Honeycomb: creating intrusion detection signatures using honeypots