Text this: MICIE: A model for identifying and collecting intrusion evidences