Just a question first. Are you trying to implement an anomaly detection module using machine learning techniques? If that is the case, you might want to start by some statistical analysis first for feature selection, maybe PCA. Also, it would be nice to know if the features you are taking using different sources can be related (or tracked down) to the same events in the network and if this relationship is easily established. A little bit more of detail will help people to give you a more complete answer :)
I believe Tim Bass has the best research on this topic. It's mostly multisensor data fusion as mentioned by Ahmad. But also things like feature selection with "feature templates" and offline data mining operations to give feedback and learning capabilities to the "real-time system". Tim's research is incredible, and I haven't seen anything close to it being implemented in the public domain. Has anyone? I believe SIEMs are still quite a bit away from this.
Intrusion Detection Systems and multi sensor data fusion: