Re: A useful oversimplification for network surveillance?

[Florian Weimer <fw () deneb enyo de>]

> We are an ISP - we look for specific trending data to help pinpoint new 
> potential virus and malware which can adversley effect transit links or 
> equiptment.

Plain IDS data, or netflow data? (I don't doubt the usefulness of flow
data.)