6Department of Defense. Trusted Computer System Evaluation Crite ria[M]. Dec. 1985.
7S R Snapp, S E Smaha, D M Teal and T Grance. The DIDS ( distributed intrusion detection system) prototype[ C ]. In USENIX Association. Proceedings of the Summer 1992 USENIX Conference,Berkeley, CA, USA, June 1992. 227.
8K A Jackson. NADIR: A prototype system for detecting network and file system abuse[ C]. Proc. of the 7th European Conference on Information Systems, Nov 1992.
9N Habra, B Le Charlier, A Mounji, I Mathieu. ASAX: Softwarearchitecture and rule - based language for universal audit trail analysis[C]. Deswarte, Y., Eizenberg, G. (eds.), Proc. of the 2nd European Symposium on Research in Computer Security ( ESORICS'92), Toulouse, France, Nov. 1992, 435-450.
10Marcelo Medina. A layered framework for placement of distributed intrusion detection devices [ C ]. In proceedings of the 21 st National Information Systems Security Conference, Crystal city, Virginia, Oct 1998.
