Re:frequent distros - already 1 step ahead (Score 1)

Why can't you jjust have a process monitor (perhaps like the freedom.net product) where you can set which programs can and can not access the internet, close unused ports, etc. If a program tried to disguise itself as an allowed program maybe even monitor for irregular internet usage activity by a program.