1. A method, comprising: performing, by one or more computers: receiving a message comprising information indicative of an event detected on one of a plurality of nodes in a distributed computing system, wherein the information comprises an indication of a resource-related, performance-related, or workload-related run-time behavior of the one of the plurality of nodes; accessing a knowledge base comprising information about run-time behaviors associated with known computing system attack patterns, wherein said run-time behaviors are indicative of known attack patterns that lead to removal or degradation of one or more nodes of a computing system by external requests to said one or more nodes; classifying the event detected on the one node as being representative of one of the known computing system attack patterns or as being representative of an unknown attack pattern, dependent, at least in part, on the knowledge base and on the information in the received message, wherein said classifying indicates a current or near-term attack on the one node by external requests to the one node; and initiating a response to the event, dependent on said classifying.