This is called intrusion detection, and there are a number of ready-made products that do it more efficiently. For an example, see tripwire. This will easily

This is called intrusion detection, and there are a number of ready-made products that do it more efficiently. For an example, see tripwire. This will easily handle /Applications/. On first run it gets a hash of all the files, and then you schedule subsequent runs in cron to see what has changed. The problem with any approach like this is that if it were in common use that it'd be easy for the malware to change tripwire itself to stop it from detection. It also won't detect something that only infects running processes, infects firmware, or otherwise leaves the local filesystem alone. That's why you'd want to have defense in depth, such as having a separate box monitoring traffic, looking for anomalies. I'm not sure what the appropriate approach would be on a end-user machine. Any security measure that's implemented in software on the machine itself is a arms race against the malware authors. This has been going on for a long time in the Windows world, and I don't think there is anything fundamentally different about Linux and OS X that would protect them if they received the same amount of attention from malware authors.