A Survey of Insider Attack Detection Research
Masquerade detection using enriched command lines