Adaptive real-time anomaly detection with incremental clustering
Specification-based anomaly detection: a new approach for detecting network intrusions