1. Porras, P. and Neumann, P. “EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances”, National Information Security Conference, 1997. http://www.sdl.sri.com/emerald/emerald-niss97.html
2. Valdes, A. and Skinner, S. “Adaptive, Model-based Monitoring for Cyber Attack Detection”, Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000. http://www.raid-symposium.org/raid2000/program.html
3. Valdes, A. and Skinner, S. “Blue Sensors, Sensor Correlation, and Alert Fusion”, Recent Advances in Intrusion Detection (RAID 2000), Toulouse, France, October 2000. http://www.raid-symposium.org/raid2000/program.html
4. Pearl, J. “Probabilistic Reasoning in Intelligent Systems”, Morgan-Kaufmann (1988).
5. Erlinger, M. and Stanniford, S. “Intrusion Detection Interchange Format”, http://www.ietf.org/html.charters/idwg-charter.html