traffic analysis worm attacks many hosts many targets growth over time these are our biggest threats to accurate detection (d)dos attacks many hosts spoofed or real usually one or many targets target list doesn't grow slashdot effect many hosts usually one target source list grows, target list doesn't