A System Architecture for Operator-Centric and Adaptive Intrusion Detection