1. A method of detecting exploits, the method comprising: receiving a file; determining whether or not the received file corresponds to any of one or more predetermined models of normal file types; and if the received file does not correspond to any of the one or more predetermined models of normal file types, flagging the received file as a potential exploit.