Ramsbrock D, Berthier R, Cukier M.  2007.  Profiling Attacker Behavior Following SSH Compromises. :119-124.