Assessing degree of intrusion scope (DIS): a statistical strategy for anomaly based intrusion detection
A framework for constructing features and models for intrusion detection systems