Models and Measures for Correlation in Cyber-Insurance
Honeycomb: creating intrusion detection signatures using honeypots