Salvatore J. Stolfo, Frank Apap, Eleazar Eskin, Katherine Heller, Shlomo Hershkop, Andrew Honig, Krysta Marie Svore. A comparative evaluation of two algorithms for Windows Registry Anomaly Detection. Journal of Computer Security, 13(4):659-693, 2005. [doi]