1. A computer-implemented method, comprising: receiving, by a computing system and for each particular application program in a group of application programs that are executing on computers in a group of computers, application status information that identifies a status of the particular application program at each of various times; using the application status information for each particular application program in the group of application programs to generate, by the computing system, multiple network signatures for multiple respective times, wherein each particular network signature of the multiple network signatures identifies, for a respective one of the multiple times, multiple statuses including a status of each of the application programs in the group of application programs, wherein a first network signature of the multiple network signatures identifies statuses of the application programs in the group of application programs at a first time of the multiple times and a second network signature of the multiple network signatures identifies statuses of the application programs in the group of application programs at a second time of the multiple times, wherein each particular network signature of the multiple network signatures includes data that identifies, for a respective one of the multiple times, which application programs in the group of application programs were executing on which computers in the group of computers at the respective one of the multiple times, and wherein each particular network signature of the multiple network signatures includes data that identifies, for a respective one of the multiple times, which of the application programs in the group of application programs were in communication with identified other application programs at the respective one of the multiple times; detecting, by the computing system and during a monitoring of the multiple network signatures, an anomaly in the generated multiple network signatures by identifying that at least one of the multiple network signatures does not conform to established normal behavior of the application programs in the group of application programs, as a result of an analysis of information in the at least one of the multiple network signatures, including: (a) an identification of statuses of the application programs in the group of application programs at a specific time, (b) an identification of which application programs in the group of application programs were executing on which computers in the group of computers at the specific time, and (c) an identification of which of the application programs in the group of application programs were in communication with identified other application programs at the specific time; and in order to avoid further anomalies, reconfiguring relationships between (i) which application programs in the group of application programs are to execute on which computers in the group of computers, or (ii) which application programs in the group of application programs are to communicate with identified other application programs.