1. A method for authenticating an attempt at establishment of a network connection by allowed code, comprising: providing a dataset having a plurality of previously observed stack trace templates each representing a stack trace pattern prevailing in stack traces recorded by monitoring a plurality of stacks of a plurality of clients executing the allowed code during a connection establishment process for establishing network connections related to the allowed code; receiving a new stack trace recorded during a new connection establishment process for a new network connection by a new client; measuring a similarity between the new stack trace and the plurality of stack trace templates to identify a match to a stack trace template; evaluating the matched stack trace template for a predefined rule requirement; and updating a rule-set database with the matched stack trace template to authenticate new network connection establishments associated with stack templates matching the matched stack trace template; wherein the plurality of stack trace templates and the new stack trace include context data collected in association with the stack trace of the allowed code, and the similarity is measured according to the context data; wherein the context data includes an event ID and/or host name.