Extrusion Detection: Security Monitoring for Internal Intrusi - Richard Bejtlich (Addison-Wesley, 2006)