Causality reasoning about network events for detecting stealthy malware activities
A data mining framework for building intrusion detection models