thoughts for the future

faster detection
tradeoff with confidence
containment
active area of study for many people
anomolous traffic to signature
honeycomb - honeyd challenge example
apply these ideas to email