John Green, David J. Marchette, Stephen Northcutt, Bill Ralph. Analysis Techniques for Detecting Coordinated Attacks and Probes. In Proceedings of the Workshop on Intrusion Detection and Network Monitoring, Santa Clara, CA, USA, April 9-12, 1999. pages 1-9, USENIX, 1999. [doi]