Information-theoretic measures for anomaly detection
A Data Mining Framework for Constructing Features and Models for Intrusion Detection Systems