The rule 40601, file `etc/rules/attack_rules.xml`, contains a link to http://project.honeynet.org/papers/enemy2/ and this link doesn't exists. Maybe it's the accessible link: http://all.net/journal/deception/www.honeynet.org/project.honeynet.org/papers/enemy2/index.html