Anomaly Prevention Systems

Mainly in research stages at this point
Work by preventing deviant behavior

System call tracking (Forrest)
Baseline system call rates
Throttle calls that are too frequent

Network flow tracking (Williamson)
Flow is a connection base (NetFlow)
Hold each client to 1 new server every second