Before revision:  Detection relies on comparing histograms of command usages of multiple logs .
After revision:  Detection relies on comparing the histograms of multiple logs' command use .