For a network security project we are listing to our network traffic of about 50-60 hosts. We aim at identifying malicious event within our network traffic by identifying network anomalies.
Our main aim is to find out if there is anomaly in our network. A special case would be to detect reboots. what would be the advantage of analyzing Network anomalies against traditional signature based approach? or what could we find out else with this information?
Note: As far as I know there is just a little bit malware, who reboot computer. Is there any anomaly causing a host to reboot?