Roland Büschkes Mark Borning Dogan Kesdogan Transaction-based Anomaly Detection. 129-140 1999 conf/id/1999 Workshop on Intrusion Detection and Network Monitoring http://www.usenix.org/publications/library/proceedings/detection99/buschkes.html db/conf/id/id1999.html#BuschkesBK99