Patent ID: 8230508

Claim:
A method of intrusion protection of a plurality of hosts, implemented by a deep-security device having at least one processor and at least one memory device, the method comprising: storing a set of intrusion patterns; storing a set of data filters, each data filter for combating at least one of said intrusion patterns; encoding a set of descriptors for characterizing said plurality of hosts; devising a set of encoded rules for selectively assigning said data filters to said plurality of hosts according to said descriptors; arranging descriptors of each said encoded rule into a tree structure having a root descriptor, inner descriptors, and leaf descriptors; sending a root descriptor to a selected host; and performing a recursive process of: receiving state information from said selected host; determining a subsequent descriptor according to said state information; where said subsequent descriptor is an inner descriptor, sending said subsequent descriptor to said selected host; and subject to an indication that said subsequent descriptor is a leaf descriptor, determining a current security configuration for said selected host.