looks good to me (and you beat me to remove 2.5 from travis setup ;) ) -- but may be worth adding a test-case where PID would differ thus should not result in the match?  just to make sure we would not start banning other connections?  also how likely it would be for the same PID to get reused on a busy server thus leading to false positives or there is no other case where "Connection closed by" would appear for some legit connections (please remind me)?