1. A method in a computer system for detecting intrusions, the method comprising: receiving a behavior profile associated with an application; reading the behavior profile associated with the application; monitoring execution of the application, according to the behavior profile; if the behavior of the application does not conform to the behavior profile, issuing a message indicating that the application is not conforming to the behavior profile.