Abstract: A computer system for intrusion detection includes a production processor and a security processor. The production processor is configured to execute one or more production processes. The security processor is dedicated to security functions and is configured to execute one or more security processes. The security process is configured to monitor the functions of the production processor and determine the occurrence of a security event. The security event may include any action performed by the production process that is considered to be threat to the security of the computer system. In some embodiments, the security process is associated with a particular production process and is configured to utilize information concerning the expected behavior of the production process while monitoring for security events.