Fixed- vs. Variable-Length Patterns for Detecting Suspicious Process Behavior.

Andreas Wespi Hervé Debar Marc Dacier Mehdi Nassehi Fixed- vs. Variable-Length Patterns for Detecting Suspicious Process Behavior. 2000 8 Journal of Computer Security 2/3 db/journals/jcs/jcs8.html#WespiDDN00