1. A method, comprising: analyzing a plurality of rules in a textual rules structure; decomposing the plurality of rules into a plurality of contexts, based on the analysis; storing the plurality of contexts into a table; generating a plurality of concatenated values, each concatenated value comprising one value associated with a context of one of the plurality of contexts joined with one value associated with at least one other context of the one of the plurality of contexts; and storing the plurality of concatenated values in a plurality of filtering tables; wherein the plurality of filtering tables include a light context filtering table storing at least one concatenated value representing a combination of light contexts, a heavy context filtering table storing at last one concatenated value representing a combination of heavy contexts, a heavy and light context filtering table storing at last one concatenated value representing a combination of at least one heavy context and at least one light context, a looping filtering table storing at least one positive context that is utilized for positively filtering values, and not looping filtering table storing at least one negative context that is utilized for negatively filtering values; wherein each of the plurality of contexts is identified as a heavy context or a light context based on a predetermined number of distinct occurrences of data in a data stream; wherein the light context is predetermined to have a fewer number of distinct occurrences in the data than a number of distinct occurrences included in the heavy context; wherein if each context in the plurality of contexts filters a plurality of values, then the plurality of values is serialized into a series of concatenated values.
4. The method of claim 1 , wherein each context may include one of a source address, a source port, a source type, a destination address, a destination port, a destination type, a protocol, a service, a reason, a product, message information, an originating number, a destination number, a time, a date, a timestamp, a duration, a flag, a condition, a session record, and an attack.