Compelling approach. Can it be implemented using existing Sourcefire / SNORT capabilities or will other mechanisms be required?