An adaptive rule evaluation system for finding malicious network traffic sent to databases, comprising: - an input for receiving time variant input data, wherein the time variant input data is network traffic; - a rule match processing module ; - an evaluation processing module ; and - an adjustment processing module ; wherein the rule match processing module is configured to process the time variant input data by means of applying several rules on the time variant input data, wherein the several rules relate to finding the malicious network traffic and comprise several criteria assigned to characteristics of the time variant input data, wherein the characteristics are time variant, wherein the rule match processing module is configured to apply the several criteria on the time variant input data, wherein the rule match processing module is configured to identify a rule hit when all criteria of the rule applied match, wherein the evaluation processing module is configured to profile and evaluate the rule processing that relates to the order of the criteria being checked with respect to a matching, thereby identifying an optimization potential of the rule processing and an optimal order of the criteria used for evaluation of the time variant input data, as the optimal order depends on the time variant input data, the rules applied and their criteria, and wherein the adjustment processing module is configured to determine an adjusted rule processing, thereby ensuring that a decisive criterion of a respective rule is checked at the beginning in order to avoid checking all criteria of the rule in case that the decisive criterion is the last one to be checked with respect to the input data and the respective rule applied on the input data. - an input for receiving time variant input data, wherein the time variant input data is network traffic; - a rule match processing module ; - an evaluation processing module ; and - an adjustment processing module ; wherein the rule match processing module is configured to process the time variant input data by means of applying several rules on the time variant input data, wherein the several rules relate to finding the malicious network traffic and comprise several criteria assigned to characteristics of the time variant input data, wherein the characteristics are time variant, wherein the rule match processing module is configured to apply the several criteria on the time variant input data, wherein the rule match processing module is configured to identify a rule hit when all criteria of the rule applied match, wherein the evaluation processing module is configured to profile and evaluate the rule processing that relates to the order of the criteria being checked with respect to a matching, thereby identifying an optimization potential of the rule processing and an optimal order of the criteria used for evaluation of the time variant input data, as the optimal order depends on the time variant input data, the rules applied and their criteria, and wherein the adjustment processing module is configured to determine an adjusted rule processing, thereby ensuring that a decisive criterion of a respective rule is checked at the beginning in order to avoid checking all criteria of the rule in case that the decisive criterion is the last one to be checked with respect to the input data and the respective rule applied on the input data. <EOS>