Intrusion Detection and Prevention System Rule Automation and Optimization

A network intrusion system for a protected network, the network intrusion system comprising:

• a ruleset module configured to:
• receive metadata for a plurality of rules, wherein the metadata describes, for each rule of the plurality of rules, a set of associated network vulnerabilities;
• and
• access vulnerability information describing a set of cumulative vulnerabilities that each is present in at least one of a plurality of network devices in the protected network;
• and
• a rule management module in communication with the ruleset module and configured to, for each rule of the plurality of rules:
• identify the set of associated network vulnerabilities described by the metadata for the rule;
• determine whether there is a match between any of the set of associated network vulnerabilities and the set of cumulative vulnerabilities;
• and
• in response to determining that there is no match, transmit a first command signal to a network security module,
• wherein the first command signal instructs the network security module to disable the rule.