Autograph: toward automated, distributed worm signature detection