I learned today that my April 2004 Sys Admin article Integrating the Network Security Model is now available online. In this article, I’ll look at the detection and validation of intrusions through an operational model called network security monitoring (NSM) I will briefly explain NSM theory and introduce several tools for integrating NSM concepts into existing prevention and detection systems. I’ve also posted.pdf and.ps versions at my TaoSecurity.com publications page. NSM uses full content, statistical, session, session and alert data to help analysts make decisions.”]
Source: https://taosecurity.blogspot.com/2004/12/april-2004-sys-admin-nsm-article.html