1. A method of detecting an intrusion into a target software system, comprising: instrumenting the target software system to generate behavior data representing a current observation or observation aggregate; processing the current observation or observation aggregate through a first level detection algorithm that provides a first, provisional indication of a possible intrusion; determining whether an intrusion has occurred or whether the current observation or observation aggregate warrants a second level examination; and if a result of executing the first level detection algorithm indicates that the current observation or observation aggregate warrants a second level examination, processing the current observation or observation aggregate through at least one or more second level detection algorithms to provide a second, more definite indication of a possible intrusion.