1. A method of improving intrusion detection in a computing network, comprising steps of: defining intrusion suspicion levels for inbound communications destined for a computing device on the computing network; and using the defined intrusion suspicion levels to determine if a particular inbound communication destined for the computing device should be treated as an intrusion event.