This is an algorithm that can be used of intrusion detection
This is the initial detection. Everything is black.
It essentially detects changes on the screen and that is painted white. If a significant portion of the screen is white, then it is classified as UNSAFE, else it is SAFE.