Frank Apap, Andrew Honig, Shlomo Hershkop, Eleazar Eskin, Salvatore J. Stolfo: Detecting Malicious Software by Monitoring Anomalous Windows Registry Accesses. RAID 2002: 36-53