this book may help:Security LogManagementIdentifying Patterns in the ChaosISBN: 1-59749-042-3I have downloaded electronic version from internet, if you can't found it, ask me to send you a copy.