For this type of situation, i would use A Behavior-based (Anomaly-based) Intrusion Detection Systems (IDS).
A Behavior-based (Anomaly-based) Intrusion Detection Systems (IDS) will create a baseline on what system activity are considerd as 'normal' or 'acceptable'. The deviation from this baseline will give the creator an alarm or notification. Because of this feature, it would be best to handle unknown or unreleased vulnerabilities