Selection, combination, and evaluation of effective software sensors for detecting abnormal computer usage. - Jude W. Shavlik; Mark Shavlik (KDD, 2004)