An attack signature is * "[a] specific sequence of events indicative of an unauthorized access attempt." * "[a]ctivities or alterations to an IS indicating an attack or attempted attack, detectable by examination of audit trail logs." * "[a] characteristic byte pattern used in malicious code or an indicator, or set of indicators, that allows the identification of malicious network activities."