A computer process for automatically selecting one or more access control entities to block a computer network attack, the process comprising: monitoring a stream of network packets over a period of time; collecting statistics about parameters of the network packets in the stream that were received during the period of time and forming a statistical record; in response to an attack, generating, based at least in part on the statistical record, an attack traffic profile; receiving a plurality of pre-existing access control entities (ACEs) and transforming each of said plurality from a first form to a second form, wherein each of the ACEs comprises a rule that describes parameters of traffic such that a device, into which the ACE is installed, can filter traffic, the device applying the rule of the ACE on a network packet by network packet basis, resulting in a determination of whether to block the packet or allow it through; comparing the attack traffic profile to each of the plurality of pre-existing access control entities (ACEs) in the second form, said comparison comprising calculating a similarity score between the attack traffic profile and each respective pre-existing ACE of the plurality of pre-existing ACEs in the second form; selecting a particular ACE to block the detected attack from the plurality of pre-existing ACEs in the second form, based at least in part on the similarity score; in response to said selection, taking at least one of the following actions: (i) providing the particular ACE to a user interface of a computer in a security operations center, wherein the particular ACE is provided in any of: the second form or another form; (ii) sending the particular ACE to a network protection device to be applied to the stream of network packets, wherein the particular ACE is sent in any of: the second form or another form. monitoring a stream of network packets over a period of time; collecting statistics about parameters of the network packets in the stream that were received during the period of time and forming a statistical record; in response to an attack, generating, based at least in part on the statistical record, an attack traffic profile; receiving a plurality of pre-existing access control entities (ACEs) and transforming each of said plurality from a first form to a second form, wherein each of the ACEs comprises a rule that describes parameters of traffic such that a device, into which the ACE is installed, can filter traffic, the device applying the rule of the ACE on a network packet by network packet basis, resulting in a determination of whether to block the packet or allow it through; comparing the attack traffic profile to each of the plurality of pre-existing access control entities (ACEs) in the second form, said comparison comprising calculating a similarity score between the attack traffic profile and each respective pre-existing ACE of the plurality of pre-existing ACEs in the second form; selecting a particular ACE to block the detected attack from the plurality of pre-existing ACEs in the second form, based at least in part on the similarity score; in response to said selection, taking at least one of the following actions: (i) providing the particular ACE to a user interface of a computer in a security operations center, wherein the particular ACE is provided in any of: the second form or another form; (ii) sending the particular ACE to a network protection device to be applied to the stream of network packets, wherein the particular ACE is sent in any of: the second form or another form. (i) providing the particular ACE to a user interface of a computer in a security operations center, wherein the particular ACE is provided in any of: the second form or another form; (ii) sending the particular ACE to a network protection device to be applied to the stream of network packets, wherein the particular ACE is sent in any of: the second form or another form.