Modeling system calls for intrusion detection with dynamic window sizes, DARPA Information Survivability Conference and Exposition II (DISCEX II), pp.165-175, 2001. ,
A markov chain model of temporal behavior for anomaly detection, IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop, pp.171-174, 2000. ,
Sequence matching and learning in Anomaly Detection for computer security, The Fourth National Conference on Artificial Intelligence, pp.43-49, 1997. ,
Detecting intrusions using system calls: alternative data models, Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344), pp.133-145, 1999. ,
DOI : 10.1109/SECPRI.1999.766910
The NIDES statistical component: description and justification, 1993. ,
Algorithms for mining distance-based outliers in large data sets, 24th Int. Conf. Very Large Data Bases, VLDB, Technique et Science Informatiques, pp.392-403, 1998. ,
Finding international knowledge of distance-based outliers, The VLDB Journal, pp.211-222, 1999. ,
LOF: identifying density-based local outliers, ACM SIGMOD Int. Conf. on Management of data, pp.93-104, 2000. ,
Intrusion detection with unlabeled data using clustering, ACM CSS Workshop on Data Mining Applied to Security (DMSA-2001), 2001. ,
Learning Profiles Based on Hirarcical Hidden Markov Model, ISMIS 2005, LNAI 3488, pp.47-55, 2005. ,
Models and Model Biases for Automatically Learning Task Switching Behavior, Proceedings of the 2005 HCI International (HCII) Conference on Augmented Cognition. HCI International (HCII) 2005 ,
Data mining approaches for intrusion detection, USENIX Security Symposium, 1998. ,
Using Unix: collected traces of 168 users includes tar-format cartridge tape, Research Report, vol.8833345, 1998. ,