There are active worms for insecure software that runs on Linux (and weak SSH passwords), so that'd be detectable. Something more like an IDS that detects know

There are active worms for insecure software that runs on Linux (and weak SSH passwords), so that'd be detectable. Something more like an IDS that detects known-insecure software and configurations is probably more useful than a pattern-matching evil bytes detector though.