I suggest you to read this article. It discusses about specific application "biosurveillance" but the introduced methods are valid for any kind of anomaly detection task.
Shmueli, Galit, and Stephen E. Fienberg. "Current and potential statistical methods for monitoring multiple data streams for biosurveillance." Statistical Methods in Counterterrorism. Springer New York, 2006. 109-140.
Thanks Hadi Fanaee Tork for the links. Looks very informative...
The problem I am interested in is:
Log from many sources, including network, security, servers, databases, applications can give information about different types of attacks, threat, vunerability e.t.c. There are attributes helping on classification of those logs. Anomaly detection schemes can be applied to those multiple attributes for identification. This process can be done in a distributed environment with limited memory contraints.