Patent ID: 7930747

Claim:
An intrusion-prevention server coupled to a plurality of hosts, said server comprising a processor and at least one memory device having computer readable instructions stored thereon for execution by the processor, forming: a plurality of data filters, each data filter corresponding to at least one intrusion pattern from among a set of intrusion patterns; a plurality of encoded descriptors for characterizing said plurality of hosts; a plurality of encoded rules; a plurality of functional expressions each associated with at least one encoded rule from among said plurality of encoded rules; a recommendation engine for identifying a subset of said encoded rules applicable to a selected host from among said plurality of hosts to assign a subset of said data filters to said selected host according to metadata received from said selected host, said metadata corresponding to selected descriptors from among said encoded descriptors; and a scheduler coupled to said recommendation engine for determining a time table for applying said subset of said encoded rules to said selected host.