[Heberlein90] L. T. Heberlein, G. V. Dias, K.N. Levitt, B. Mukherjee, J. Wood, and D. Wolber, A Network Security Monitor, Proceedings of the 1990 IEEE Symposium on Research in Security and Privacy, May, 1990 pp296-303. [This paper describes a monitor that compares current traffic patterns in an Ethernet to historical traffic patterns and triggers alarms when those patterns differ in particular ways. This paper concentrates on external intrusions into an otherwise trusted local area network.]