I realize AV software applies heuristics to identify some attacks, but in the absence of intent, it is impossible to do it effectively. One man's botnet is anot

I realize AV software applies heuristics to identify some attacks, but in the absence of intent, it is impossible to do it effectively. One man's botnet is another man's legitimate computing cluster. Unless you warn about everything going on in the system, you are not really aware of everything. If you do warn about everything, the user will start to ignore the warnings.