using in worm detection blackhole networks watch traffic characteristics number of sources, destinations service profiles data growth can indicate a worm at work must frequently examine data honeypot deploy as a reactionary measure catch worm for later study "petri dish" approach to worm detection