Intrusion Protection Blocks Local Host

Intrusion protection would sometimes display an alert that the localhost was attacking the computer (although it didn’t add local host to the blocked ip list which is the default I had set).  Eventually I just turned it off.  Any idea why its reporting this?