Dynamic Provisioning of Protection Software in a Host Intrusion Prevention System

At a server supporting a plurality of hosts, a method of intrusion prevention comprising:

• maintaining a set of filters, each filter being a set of instructions;
• selecting a target host from among said plurality of hosts;
• determining a subset of rules, from among a predefined set of rules, applicable to said target host;
• prompting said target host to provide metadata characterizing said target host, said metadata including a plurality of data elements;
• receiving said metadata from said target host;
• executing said subset of rules to determine applicable filters from among said set filters;
• and
• transmitting said applicable filters to said target host.

An intrusion-protection method for protecting a plurality of hosts, the method comprising:

• identification of intrusion patterns;
• devising a set of data filters, each data filter corresponding to at least one of said intrusion patterns;
• formulating a set of descriptors for characterizing said plurality of hosts;
• determining a set of rules, each rule associated with a respective data filter in said set of data filters and with a subset of descriptors from among said set of descriptors;
• executing, for a selected host, a selected rule from among said set of rules using content of a respective subset of descriptors;
• and
• ascertaining relevance of a specific data filter associated with said selected rule to said selected host according to a result of said executing.