Abstract: A computer-implemented system captures raw Internet Protocol (IP) packets using a traffic inspection subsystem (e.g., an extended Berkeley packet filter (eBPF) subsystem). It then reassembles the raw IP flows into Layer 7 (OSI model application layer) flows. Once the Layer 7 protocol flows (e.g., HTTP, FTP, SMTP) are reassembled, the system may apply dynamic contextual rules to the reassembled flows to determine whether the client communicating with an application being protected has any malicious intent. If the system identifies any such malicious intent, the system blocks further communications from the client, such as by dropping requests, rejecting requests with a custom response, or other means.