It would be a VERY interesting research study if someone were to take these systems and put them through their paces, so to speak, with a series of very comprehensive and realistic experiments. By comprehensive I mean that as many different attack and misuse types are tested as possible. I am working on profiling users based on their use of certain commands. Unix1 indicates use of commands such as mv, cp. Unix2 indicates use of commands such as awk, find.
Mail indicates use of any mailing tools.
News indicates use of any news group readers. Ed indicates use of the editors vi or emacs. Int indicates use of internet commands such as telnet, ftp, etc. HAR and BAD look for specific attack signature related commands. I also realize that most system administrators do not have these tools.