https://www.researchgate.net
http://www.academia.edu/9203318/Enhancing_SIEM_Correlation_Rules_Through_Baselining