Gaeil Ahn Kiyoung Kim Active Host Information-Based Abnormal IP Address Detection. 689-698 http://springerlink.metapress.com/openurl.asp?genre=article&issn=0302-9743&volume=3421&spage=689 2005 conf/icn/2005-2 ICN (2) db/conf/icn/icn2005-2.html#AhnK05