When SQL Slammer flooded Intranets a few years ago, even the laziest administrators got aware of the danger of viruses and worms and the importance of network security. Ness Shroff and colleagues (Ohio State University, Dept. of electrical and computer engineering) developed a simple but effective measure to recognize worm attacks within a few minutes: by monitoring the number of network scans a machine sends out, they are able to determine a possible attacker, since infected machines usually do numerous scans in order to find new victims. (Source)

This approach is interesting, because it is a first step to regard the network as organism that must develop sort of an immune system to find out what parts are infected. Asking the meds how the body implements his immune answer could be rewarding, because a.) several possible measures against intruders might be imaginable (up to fever), and b.) the immune system is an adaptive system that gains knowledge and that has a memory. Such an adaptive system that is capable of learning might stop the usual game of cat-and-mouse between intruders and security experts.