A. Wool. Packet filtering and stateful firewalls. In H. Bidgoli, editor, Handbook of Information Security, volumeIII: Threats, Vulnerabilities, Prevention, Detection and Management, chapter171, pages 526--536. John Wiley & Sons, 2006.
Here is a local copy (pdf).
 M. Faisal, A. A. Cardenas, and A. Wool. Profiling communications in industrial IP networks: Modelcomplexity and anomaly detection. In Cristina Alcaraz, editor, Security and Privacy Trends in the Industrial Internet of Things, pages 214--225. Springer, 2019.