11，Bishop M. A model of security monitoring. In: Proceedings of the 5th Annual Computer Security Applications Conference. 1989. 46～52. http://seclab.cs. ucdavis.edu/papers.html
22，Staniford-Chen S, Cheung S, Crawford R et al. GrIDS: a graph based intru sion detection system for large networks. In: Proceedings of the 19th National Information Systems Security Conference, Vol 1. National Institute of Standards a nd Technology, 1996. 361～370
33，Hochberg J, Jackson K, Stallings C et al. NADIR: an automated system for detecting network intrusion and misuse. Computers and Security, 1993,12(3):235～2 48
44，White G B, Fisch E A, Pooch U W. Cooperating security managers: a peer-based intrusion detection system. IEEE Network, 1996，10(1):20～23
55，Forrest S, Hofmeyr S A, Somayaji A. Computer immunology. Communications of th e ACM, 1997,40(10):88～96
66，Hunteman W. Automated information system alarm system. In: Proceedings of the 20th National Information Systems Security Conference. National Institute of Standards and Technology, 1997
77，Porras P A, Neumann P G. EMERALD: event monitoring enabling responses to anom alous live disturbances. In: Proceedings of the 20th National Information System s Security Conference. National Institute of Standards and Technology, 1997
8Wong D，Mobile Agents First Int Workshop MA'97，1997年
9Young A，Proc of the 4th Int Workshop FSE'97，1997年
10Kumar G.Classification and detection of computer intrusion[]..1995
6Athanasiades N,Abler R,Levine J,et al.Intrusion detection testing and benchmarking methodologies[C]//Proceedings of the IEEE Information Assurance Workshop.[s.l.]:[s.n.],2003:63-72.
7Antonatos S,Kostas G,Anagnostakis,et al.Generating realistic workloads for network intrusion detection systems[C]//Proceedings of the fourth international workshop on Software and performance.[s.l.]:[s.n.],2004:207-215.
