EMERALD: Event monitoring enabling responses to anomalous live disturbances (1997)

by P A Porras, P G Neumann
Venue:In Proc. 20th NISTNCSC National Information Systems Security Conference