Smart intrusion prevention policy

A computer program product for prioritizing intrusion events that enhances the efficiency of signature matching of malicious activity, the computer program product comprising:

• one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media, the program instructions comprising:
• responsive to determining that a new connection corresponding to a transmitted data packet is detected, program instructions to add a connection context associated with the new connection to a current connection context in a dynamic event table, wherein:
• the connection context is based on one or more of:
• an operating system type associated with the connection, an operating system version associated with the connection, and an application responsible for sending the data packet associated with the connection, and
• the dynamic event table includes the current connection context, one or more previous connection contexts, and a listing of two or more events, wherein each event of the two or more events is a malicious activity and is associated with a respective data packet;
• program instructions to calculate a score for each event of two or more events in the dynamic event table based on the current connection context;
• program instructions to perform a signature check of each event having a score greater than or equal to a threshold value among the two or more events according to a prioritized order based on the calculated score;
• and
• responsive to determining that a signature was found for an event among the two or more events, program instructions to prevent intrusion of the data packet associated with the event.

A computer system for prioritizing intrusion events that enhances the efficiency of signature matching of malicious activity, the computer system comprising:

• one or more computer processors;
• one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
• responsive to determining that a new connection corresponding to a transmitted data packet is detected, program instructions to add a connection context associated with the new connection to a current connection context in a dynamic event table, wherein:
• the connection context is based on one or more of:
• an operating system type associated with the connection, an operating system version associated with the connection, and an application responsible for sending the data packet associated with the connection, and
• the dynamic event table includes the current connection context, one or more previous connection contexts, and a listing of two or more events, wherein each event of the two or more events is a malicious activity and is associated with a respective data packet;
• program instructions to calculate a score for each event of two or more events in the dynamic event table based on the current connection context;
• program instructions to perform a signature check of each event having a score greater than or equal to a threshold value among the two or more events according to a prioritized order based on the calculated score;
• and
• responsive to determining that a signature was found for an event among the two or more events, program instructions to prevent intrusion of the data packet associated with the event.