I keep looking into statistical methods to help me with this. on the theory that for the most part log traffic is normal so I could have a dashboard item on how

I keep looking into statistical methods to help me with this. on the theory that for the most part log traffic is normal so I could have a dashboard item on how statistically anomalous my logs are. so I start by reading up on how email spam engines work, get hung up on locality aware hashing and then give up for a couple months. Any hints on good papers in this domain?