A mechanism is provided in which dynamic rules for Internet protocol addresses
which should be inaccessible from an organization are determined. Keywords are
entered into a search table. A sliding scale is established for the severity and
frequency of possible filtered terms. For example, a term may be awarded a point
value based on the severity and frequency of the term. An organizational policy
may be established based upon the total number of points per document served from
an Internet protocol address or an average point value for documents served from
an Internet protocol address with respect to a threshold. The length of time or
number of documents permitted before a decision is reached, namely a decision interval,
may be established. A reset policy may be determined to dictate what actions will
be taken after the decision interval is reached.
