Haakon Ringberg Matthew Roughan Jennifer Rexford The need for simulation in evaluating anomaly detectors. 55-59 2008 38 Computer Communication Review 1 http://doi.acm.org/10.1145/1341431.1341443 db/journals/ccr/ccr38.html#RingbergRR08