Molina J, Chorin X, Cukier M.  2007.  Filesystem activity following a SSH compromise: an empirical study of file sequences. :144-155.