A Serial Combination of Anomaly and Misuse IDSes Applied to HTTP Traffic. - Elvis Tombini; Hervé Debar; Ludovic Mé; Mireille Ducassé (ACSAC, 2004)

WebAnalyzer: accurate detection of HTTP attack traces in web server logs. - Hervé Debar; Elvis Tombini (Ann. des Télécommunications, 2006)