Nick G. Duffield, Patrick Haffner, Balachander Krishnamurthy, Haakon Ringberg: Rule-Based Anomaly Detection on IP Flows. INFOCOM 2009: 424-432