Priority based deep packet inspection

A network monitor system comprising:

• a memory configured to store instructions;
• a processor and in communication with the memory, wherein the processor upon execution of the instructions is caused to:
• receive a packet of network traffic;
• determine a source IP address of the packet;
• consult a database of source IP addresses, each source IP address stored in the database having an associated probability of threat indicator (PTI), wherein the PTI indicates a probability of threat posed by the source IP address;
• compare of the packet's source IP address' PTI to a plurality of thresholds each corresponding to a different one of a plurality of inspection checks;
• determine, based on the comparison, a subset of inspection checks each corresponding to a respective threshold of the plurality of thresholds that the packet's source IP address' PTI exceeds;
• perform, each inspection check of the subset of inspection checks;
• assign treatment of the packet based on a result of the subset of inspection checks that were performed;
• and
• adjust the packet's source IP address' PTI in the database of source IP addresses and the packet's PTI based on the result of the subset of inspection checks that were performed.

A non-transitory computer readable storage medium storing one or more computer programs embedded therein, the computer programs comprising instructions, which when executed by a computer system, cause the computer system to:

• receive a packet of network traffic;
• determine a source IP address of the packet;
• consult a database of source IP addresses, each source IP address stored in the database having an associated probability of threat indicator (PTI), wherein the PTI indicates a probability of threat posed by the source IP address;
• compare of the packet's source IP address' PTI to a plurality of thresholds each corresponding to a different one of a plurality of inspection checks;
• determine, based on the comparison, a subset of inspection checks each corresponding to a respective threshold of the plurality of thresholds that the packet's source IP address' PTI exceeds;
• perform, each inspection check of the subset of inspection checks;
• assign treatment of the packet based on a result of the subset of inspection checks that were performed;
• and
• adjust the packet's source IP address' PTI in the database of source IP addresses and the packet's PTI based on the result of the subset of inspection checks that were performed.