The “invader” warning is a BEHAVIOURAL detection of the proactive defense module… it does not rely on signautres but monitors suspicous behaviour, including all your “safe” programs which may sometimes also behave suspiciously (e.g. injecting code into processes, like a trojan)
If you trust the program, add it to the trustedzone and you will not get the same alert again.

It is quite easy to understand why it is flagging the process, if you read the darn alert.