] The company's long-term plans are more ambitious.
] Worm-killing functionality called "behavior blocking" is
] slated for next year, and will work, Gates promised, by
] spotting anomalous behavior by the operating system or
] applications. Using last year's Blaster worm as an
] example, Gates said the technology would notice that
] Windows' RPC service had begun downloading malicious
] code, and would intervene to prevent it. "The system will
] truly know what actions are allowed by applications and
] operating systems," said Gates.

Instead of trying fancy-pants AI to detect the 1 time out of a million you are downloading malicious code, why don't you fix your security model? You can start by removing the HTML rendering engine from the kernel.

The Register - Microsoft XP SP2 security attempts