Creating Profiles of Suspicious Behavior to Locate Plausible Evidence of Targeted Attacks