Ke Wang, Janak J. Parekh, Salvatore J. Stolfo: Anagram: A Content Anomaly Detector Resistant to Mimicry Attack. RAID 2006: 226-248