John Dwyer Traian Marius Truta Finding anomalies in windows event logs using standard deviation. 563-570 2013 CollaborateCom https://doi.org/10.4108/icst.collaboratecom.2013.254136 https://ieeexplore.ieee.org/document/6680025/ conf/colcom/2013 db/conf/colcom/colcom2013.html#DwyerT13