Modeling and efficiently detecting security-critical sequences of actions