I had an idea a while back for a HIDS or at least post-infection analysis. You record incoming data and files onto storage. Have a separate machine running it which is instrumented to check all jumps, etc against a whitelist generated when compiling same system. It would eventually spot the compromise plus be able to show the exact sequence of data &amp; instructions that caused it. Which would aid patching it.<p>Stayed on prevention instead. Thought it would be fun building &amp; optimizing it, though.