Stefan Axelsson Visualising Intrusions: Watching the Webserver. 259-274 2004 conf/sec/2004 SEC db/conf/sec/sec2004.html#Axelsson04