claus - 7:02 pm on Feb 5, 2005 (gmt 0)
give it a second thought theBear :) There are a number of ways you could do it, one would be to establish a baseline and then just monitor changes to this and factor those changes in. Depending on how you do it, this would surely lead to sandbox-like things at some point. Another would be to rotate the calculations among subsets of the data, or use aggregates (eg. domains, hosts) - in both cases use these to establish some "distance metrics" or whatever you would call it... there's a lot of room for creativity here.