1. A method comprising: at a network protection device: receiving a first rule set; receiving a second rule set; preprocessing the first rule set and the second rule set; configuring the network protection device to process packets in accordance with the first rule set; receiving packets; processing a first portion of the packets in accordance with the first rule set; reconfiguring the network protection device to process packets in accordance with the second rule set; and processing a second portion of the packets in accordance with the second rule set.