Coordinated application firewall

A method comprising:

• implementing a firewall appliance for a service request;
• operating a first micro-security application to generate an anomaly alert for the service request;
• and
• operating a second micro-security application to receive the anomaly alert from the first micro-security application or from another micro-security application and to determine whether the service request corresponds to a non-benign behavior.

A server comprising:

• an interface to receive a service request;
• and
• a processor coupled to the interface to receive the service request, the processor configured to:
• implement a firewall appliance for the service request;
• operate a first micro-security application to generate an anomaly alert for the service request;
• and
• send the anomaly alert to a second micro-security application external to the server to determine whether the service request corresponds to a non-benign behavior.

A server comprising:

• means for implementing a firewall appliance for a service request;
• means for operating a first micro-security application to generate an anomaly alert for the service request;
• and
• means for operating a second micro-security application to receive the anomaly alert from the first micro-security application or from another server's micro-security application and to determine whether the service request corresponds to a non-benign behavior.