Detecting Network Intrusions from Authentication Logs