Tom Fawcett Foster J. Provost Activity Monitoring: Noticing Interesting Changes in Behavior. 53-62 1999 KDD http://doi.acm.org/10.1145/312129.312195 db/conf/kdd/kdd99.html#FawcettP99