A close look on n-grams in intrusion detection: anomaly detection vs. classification
Using an Ensemble of One-Class SVM Classifiers to Harden Payload-based Anomaly Detection Systems