[Garvey91] Model-Based Intrusion Detection T.D. Garvey and T.F. Lunt Proceedings of the 14th National Computer Security Conference, p 372