learning rules from system call arguments and sequences for anomaly 20 detection .
a geometric framework for unsupervised anomaly detection : detecting intrusions in unlabeled data .