1. A method of detecting security threats in a computer network, the method comprising: receiving a data stream which represents outbound, application layer messages from a first computer process to at least one second computer process wherein the computer processes are implemented on one or more computers; monitoring the data stream to detect a security threat based on a whitelist having entries which contains metadata, the whitelist describing legitimate application layer messages based on a set of heuristics; and generating a signal if a security threat is detected.