Honeycomb: creating intrusion detection signatures using honeypots
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics