I don't know if this is what's happening on your computer, but sometimes if you're watching streaming video the content provider will attempt to scan your computer to determine processor speed, etc. This is done in order to stream as much date as you can handle without locking you up. This will normally pass your hardware firewall (router) but I've noticed Zone Alarm will often log it as an intrusion attempt.
Take a look at the firewall log to see if the sites listed seem familiar.