1. A method of detecting intrusions on a computer, comprising: identifying an internet protocol field range describing fields within internet protocol packets received by a computer; establishing a connectivity range describing a distribution of network traffic received by said computer; determining an internet protocol field threshold and a connectivity threshold from said internet protocol field range and said connectivity range, respectively; during the operation of said computer, calculating values for said internet protocol field range and said connectivity range; and comparing said values to said internet protocol metric threshold and said connectivity metric threshold so as to identify an intrusion on said computer.