1. Porras, P. and Neumann, P. “EMERALD: Event Monitoring Enabling Responses to Anomalous Live Distrurbances”, National Information Security Conference, 1997.
http://www.sdl.sri.com/emerald/emerald-niss97.html
2. Valdes, A. and Anderson, D. “Statistical Methods for Computer Usage Anomaly Detection”, Third International Workshop on Rough Sets and Soft Computing, San Jose, CA, 1995.
3. P. A. Porras and A. Valdes. Live traffic analysis of TCP/IP gateways. In Proceedings of the Symposium on Network and Distributed System Security. Internet Society, March 1998.
4. Pearl, J. “Probabilistic Reasoning in Intelligent Systems”, Morgan-Kaufman (1988).
5. Boyen, X. and Koller, D. “Tractable Inference for Complex Stochastic Processes”, Proceedings of the 14th Annual Conference on Uncertainty in Artificial Intelligence (UAI-98), Madison, WI, July 1998.
http://robotics.Stanford.EDU/xb/uai98/index.html