Structuring data and pre-compiled exception list engines and internet protocol threat prevention

A method of sorting a plurality of internet protocol (IP) addresses, each IP address having a numeric value within a range of numeric values, and filtering packets over a network connection based on the sorted IP addresses, the method comprising:

• dividing the range into a plurality of clusters representing a plurality of sub-ranges, each sub-range encompassing substantially the same number of numeric values of the range and each sub-range associated with a different cluster;
• assigning each IP address to the cluster associated with the sub-range that includes the numeric value of said IP address, each cluster having a cluster size defined by the number of IP addresses assigned to that cluster;
• ordering the clusters by cluster size;
• assigning the IP addresses in each cluster to one of a plurality of pages, each page having a same page size limit defining the maximum number of IP addresses that can be assigned to that page, and each page having a page size defined by the number of IP addresses assigned to that page, wherein at least one of the plurality of pages is assigned the IP addresses of a plurality of clusters such that the sum of the cluster sizes of the clusters of the assigned IP addresses is less than or equal to the page size limit of the page to which the IP addresses are assigned;
• if one or more of said pages has a page size less than its page size limit, duplicating on said page one or more of the IP addresses assigned to that page to increase the page size of said page to its page size limit;
• and
• ordering, for each page, the IP addresses assigned to said page by numeric value;
• generating at least one bloom filter for at least one of said pages, the bloom filter identifying IP addresses that are not assigned to said page but are within a sub-range associated with said page;
• receiving, over the network connection, a packet having a source IP address;
• identifying whether the source IP address is assigned to the at least one page by checking the bloom filter generated therefor;
• searching the at least one page only if the IP address is identified as being assigned thereto;
• and
• determining whether to allow the packet to proceed based on if the source IP address is an allowable IP address in the at least one page and to deny the packet from proceeding if the source IP address is a blocked IP address in the at least one page.