Honeycomb is a system for automated generation of signatures for network intrusion detection systems (NIDSs). The system applies protocol analysis and pattern-detection techniques to traffic captured on honeypots. Using traffic on honeypots has the major advantage of concentrating on traffic that can be considered malicious by definition.
