Yan Zhai Peng Ning Purush Iyer Douglas S. Reeves Reasoning About Complementary Intrusion Evidence. 39-48 2004 conf/acsac/2004 ACSAC http://doi.ieeecomputersociety.org/10.1109/CSAC.2004.29 db/conf/acsac/acsac2004.html#ZhaiNIR04