Andreas Wespi Marc Dacier Hervé Debar Intrusion Detection Using Variable-Length Audit Trail Patterns. 110-129 2000 conf/raid/2000 Recent Advances in Intrusion Detection http://link.springer.de/link/service/series/0558/bibs/1907/19070110.htm db/conf/raid/raid2000.html#WespiDD00