The problem will usually be defining "normal" traffic against which you can detect the anomalies. From past research, ensemble classifiers seem to be most efficient in lowering your false positives.
How good is the technology behind the fraud detection tools that the financial sector deploy in terms of anomaly detection?