1. A method for intrusion detection analysis comprising: performing a first analysis of a request received via a network, wherein the first analysis results in a first event indicating a type of a network protocol anomaly determined via the first analysis to be associated with a propagation attempt of the request received via the network; performing a second analysis, wherein the second analysis analyzes the first event by comparing the first event against a plurality of refinement rules; providing a refined event in which a network protocol anomaly attribute of the first event has been modified from a first network protocol anomaly value associated with the type of the network protocol anomaly to a refined event type value associated with a name of a malicious program determined via the second analysis to be attempting to propagate using the type of the network protocol anomaly associated with the request received via the network in response to the first event matching a first refinement rule of the plurality of refinement rules; generating a second event different from the first event and the refined event in response to the first event matching a second refinement rule of the plurality of refinement rules different from the first refinement rule; wherein the first event, the second event, and the refined event comprise the malicious program within a content portion of the data; wherein the content portion of the data is not analyzed in the first analysis; wherein the first event type value does not uniquely identify the malicious program; and wherein the refined event type value uniquely identifies the malicious program based on the content portion of the request analyzed in the second analysis.