overview

motivation
signature based methods
traffic analysis
analyzing the worm's scan engine
blackhole and honeypot detection
thoughts for the future
conclusions