Marcus J. Ranum's "Artificial Ignorance" concept is pretty good. I did an implementation and have been running it for more than 10 years: http://www.ranum.com/

Marcus J. Ranum's "Artificial Ignorance" concept is pretty good. I did an implementation and have been running it for more than 10 years: http://www.ranum.com/security/computer_security/papers/ai/ http://www.ranum.com/security/computer_security/papers/ai/ Someone's also done a Python implementation: https://github.com/lchamon/ai https://github.com/lchamon/ai ...and it looks like there's one in syslog-ng Premium Edition: https://syslog-ng.com/documents/html/syslog-ng-pe-latest-guides/en/syslog-ng-pe-guide-admin/html/concepts-artificial-ignorance.html https://syslog-ng.com/documents/html/syslog-ng-pe-latest-gui...