Benjamin Morin, Hervé Debar: Correlation of Intrusion Symptoms: An Application of Chronicles. RAID 2003: 94-112