Application-specific network intrusion detection

A machine-readable medium embodying machine instructions for causing one or more machines to perform operations comprising:

• examining a set of instructions embodying an invoked application to identify the invoked application;
• obtaining an application-specific intrusion detection signature;
• and
• monitoring network communications for the invoked application using the application-specific intrusion detection signature to detect an intrusion.

A system comprising:

• a network;
• a security operation center coupled with the network;
• and
• one or more machines coupled with the network, each machine comprising a communication interface and a memory including an execution area configured to perform operations comprising examining a set of instructions embodying an invoked application to identify the invoked application, obtaining application-specific intrusion criteria, and monitoring network communications for the invoked application using the application-specific intrusion criteria to detect an intrusion.

A system comprising:

• a security operation center;
• one or more machines, each machine including means for identifying a process, obtaining a process-specific intrusion detection signature, and monitoring network communications for the process using the process-specific intrusion detection signature to detect an intrusion;
• and
• communication means coupling the one or more machines with the security operation center.