Verify Results of Network Intrusion Alerts Using Lightweight Protocol Analysis. - Jingmin Zhou; Adam J. Carlson; Matt Bishop (ACSAC, 2005)