Building an Intrusion-Detection System to Detect Suspicious Process Behavior.

Andreas Wespi Hervé Debar Building an Intrusion-Detection System to Detect Suspicious Process Behavior. 1999 Recent Advances in Intrusion Detection http://www.raid-symposium.org/raid99/PAPERS/Wespi.pdf db/conf/raid/raid1999.html#WespiD99