On The Application Of Locality To Network Intrusion Detection: Working-Set Analysis Of Real And Synthetic Network Server Traffic