Patent ID: 8225398

Claim:
A recommendation engine coupled to a server computer in communication with a plurality of hosts, the recommendation engine comprising: computer readable intrusion-protection instructions stored in a memory device, which cause a processor of said server computer to: determine a host type, from among a predefined set of host types, of a target host; determine a set of host-specific descriptors applicable to said host type; send queries to said target host according to said set of host-specific descriptors; determine a current host-protection configuration for said target host according to responses to said queries; detect discrepancy between said current host-protection configuration and a prior host-protection configuration; install said current host-protection configuration in said target host upon detecting said discrepancy; record successive host-reconfiguration periods, a host reconfiguration period being a difference between successive instants of time at which a current host-protection configuration differs from a prior host-protection configuration; determine a monitoring period for said target host according to a value of at least one of said successive host-reconfiguration periods; and a scheduler for activating said intrusion-protection instructions according to said monitoring period.