As a former resident of 42, Foxhill Road, Reading, RG1 5QS, UK, let me tell you that the roar of your Concorde's engines would regularly stop cricket play at the University of Reading. You insensitive clod.

John McCain never left his email server open for this sort of exploit!

What you do is tail all your logs to a console, sit Neo in front of said console, and have him detect changes in the patterns.

I once worked for a network security startup that had almost exactly this strategy.

They didn't do very well, I'm afraid.