Why not (Score 1)

I don't see why it can't be done. I have written some security tools using heuristic logic and fault trees and it would seem to me that both would work well for something along these lines.