1. A method for generating a blacklist of network addresses for a user of a network, the method comprising the steps of: collecting security log data from one or more users of the network, the security log data identifying one or more observed attacks on the one or more users by one or more attack sources; assigning at least one of the one or more attack sources to the blacklist based on a combination of a relevance of the at least one of the one or more attack sources to the user and a maliciousness of the at least one of the one or more attack sources; and outputting the blacklist.