Honeycomb is a system for automated generation of signatures for network intrusion detection systems (NIDSs) by applying protocol analysis and pattern-detection techniques to traffic captured on honeypots. It is particularly effective at spotting worms and can create detailed signatures for known threats like Slammer and Code Red. The system can be used to actively search for signatures in any kind of traffic and has potential applications in spam detection.