diff --git a/security/README.md b/security/README.md
index f380045..6e963dc 100644
--- a/security/README.md
+++ b/security/README.md
@@ -6,8 +6,9 @@
 * [Making Programs Forget: Enforcing Lifetime For Sensitive Data (2011)](https://www.usenix.org/events/hotos11/tech/final_files/Kannan.pdf)
 * [Breach: Reviving The Crime Attack (2013)](http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf)
 * [Why Silent Updates Boost Security (2009)](http://www.techzoom.net/Papers/Browser_Silent_Updates_%282009%29.pdf)
-* :scroll: [Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud (2014)](macaroons-cookies-with-contextual-caveats.pdf)
+* [A survey of coordinated attacks and collaborative intrusion detection (2010)](https://www.tk.informatik.tu-darmstadt.de/fileadmin/user_upload/Group_TK/zhou2010survey.pdf)
 
+* :scroll: [Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud (2014)](macaroons-cookies-with-contextual-caveats.pdf)
 * :scroll: [Insertion, Evasion, and Denial of Service: eluding network intrusion detection (1998)](ids-evasion-ptacek-newsham.pdf)
 * :scroll: [SoK: Eternal War in Memory (2013)](sok-eternal-war-in-memory.pdf)
    - Classifies memory attacks into a taxonomy that is usable by both black- and white-hats.