Programs seem to exhibit remarkable amounts of find-grained consistency when operating normally; this can be used to detect anomalies.
Since we now know what’s “good”, we can report badness that we have never seen before
Will not help to do things like determine that a user has stolen another user’s password
A solution for one host, not an entire site
Current system runs off-line (on-line planned)