Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation
Experience with EMERALD to Date