1. A method comprising: receiving, with the network device, security classification information that identifies at least one mapping between a security class and at least one computing device, wherein the security class identifies security capabilities of the at least one computing device; receiving, with the network device, network traffic associated with the at least one computing device; applying, with the network device, a set of patterns defined by a policy associated with the security class to the network traffic to detect any of a corresponding set of network attacks; and forwarding, with the network device, the network traffic based on the application of the set of patterns.