A close look on n-grams in intrusion detection: anomaly detection vs. classification
a geometric framework for unsupervised anomaly detection : detecting intrusions in unlabeled data .