the challenge detect a worm quickly, within the hour fingerprint the worm know its characteristics suggest defenses try and avoid false positives, false negatives