1. A method comprising: determining, by an application rule enforcer component of a machine, whether a request for access to network services from an invoked application violates an application-specific network policy associated with the invoked application; blocking, by a network traffic enforcer component of the machine, network packets for the invoked application in response to determining that the request violates the application-specific network policy; analyzing, by an intrusion detector component of the machine, the blocked network packets to detect a network intrusion; determining, by the intrusion detector component, whether the invoked application is behaving abnormally; loading, by the intrusion detector component, application-specific monitoring parameters for the invoked application in response to determining that the invoked application is behaving abnormally; and checking, by the intrusion detector component, network packets for the invoked application based on the loaded application-specific monitoring parameters.