Aaron Schwartzbard, Anup K. Ghosh: A Study in the Feasibility of Performing Host-Based Anomaly Detection on Windows NT. Recent Advances in Intrusion Detection 1999