Peng Ning Dingbang Xu Learning attack strategies from intrusion alerts. 200-209 2003 conf/ccs/2003 ACM Conference on Computer and Communications Security http://doi.acm.org/10.1145/948109.948137 db/conf/ccs/ccs2003.html#NingX03