1. A system, comprising: a processor configured to: receive a rule to be applied to network traffic associated with members of a dynamic address group; receive virtual machine information associated with a first virtual machine instance executing on a host machine; determine, based at least in part on at least a portion of the received virtual machine information, that the first virtual machine instance belongs to the dynamic address group; in response to the determination, apply the rule to network traffic associated with the first virtual machine instance; at a time subsequent to applying the rule to network traffic associated with the first virtual machine instance, determine that the rule should be recompiled into a recompiled rule, at least in part based on a change to membership in the dynamic address group, wherein the change to membership includes at least one of: (1) an addition of an additional virtual machine instance to the dynamic address group; and (2) a removal of the first virtual machine instance from the dynamic address group; and in the event the change to the membership in the dynamic address group includes the addition of the additional virtual machine instance to the dynamic address group, applying the recompiled rule to network traffic associated with additional virtual machine instance; and in the event the change to the membership in the dynamic address group includes removal of the first virtual machine instance from the dynamic address group, not applying the recompiled rule to network traffic associated with the first virtual machine instance; and a memory coupled to the processor and configured to provide the processor with instructions.