Identification of "long running" patterns

Hello guys,

I have changed my job into the security niche and I am currently researching the question about "long running attacks". Currently, I haven`t found much. However, I believe it is possible to use machine learning to extract such long running patterns on log files from different sources.

• Is there any research done on "long term anomaly detection"? Any ideas how to realize such a method?
• Are there still some open problem in this niche?

I really appreciate your answer!