consider including network baseline methodology

[glallen01]

reference based on SiLK:
http://resources.sei.cmu.edu/asset_files/TechnicalReport/2012_005_001_28167.pdf

example from this document, starting point to identify webservers from netflow:
webservers = sport ( 80, 443, 8080, ... ), protocol 6, number of packets >4 (to ensure full TCP session), ACK set (to eliminate sessions with just SYN,RST), bytes >= 1% of all sessions

If you can methodically baseline all traffic based on flows, then anomalies will be more apparent.
The CMU document covered web, smtp, dns, and vpn in detail, with advice on validation of known good and anomalies.

This kind of baselining could also be used to tune both signature based IDS's and protocol inspection with tools like Bro