1. A method of detecting an intrusion into a target software system, comprising: instrumenting the target software system to generate event streams representing a current observation or observation aggregate; processing the current observation or observation aggregate through a first level detection algorithm that provides a first, provisional indication of a possible intrusion; determining whether the current observation or observation aggregate warrants a second level examination, wherein the determining step is performed as the event streams are being generated and by the first level detection algorithm computing an approximation of a given function; and if a result of executing the first level detection algorithm indicates that the current observation or observation aggregate warrants a second level examination, processing the current observation or observation aggregate through at least one or more second level detection algorithms to provide a second, more definite indication of a possible intrusion; suspending operation of the target software system during the step of processing the current observation or observation aggregate through the one or more second level detection algorithms; wherein the suspending step conditionally suspends a given operation of the target software system that is suspected of being a target of the intrusion.