[Ko94] C. Ko, G. Fink, and K. Levitt Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring, 1994 Computer Security Applications Conference. [This paper describes a method for matching a trusted program's specification against its behavior to find inconsistencies between audit trails and expected behavior.]