Is there any evidence that this works in the sense of foiling sophisticated attacks?
There are some reports from Google as well that you may find around, and at least at the time (few years back) they make the same observation we do with my coworkers: the rate of false positive remains high, and thus it is the job of trained security operators to spot the sophisticated attacks.
Empowering the operators with more data mining tools is a good step not yet fulfilled I believe.