A shellcode mutation engine, can evade NIDS. from the doc: 'I have chosen to attack the signature analysis method with a technique very well known to virus enthusiasts, a polymorphic algorithm that is designed to impair the effectiveness of regexp's against known attack signatures. (signatures are typically several bytes that are known to be the same for every execution of the exploit).'