https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-relationship-analysis-37352