Ch. Krügel, G. Vigna, W. Robertson: "A multi-model approach to the detection of web-based attacks"; Computer Networks, 48 (2005), 5; 717 - 738.
http://aleph.ub.tuwien.ac.at/F?base=tuw01&func=find-c&ccl_term=AC05936380