Code Optimization for Performance

Check Point's log-analysis service scans firewall packet logs against a blocklist of known-bad source IPs. A junior engineer's first pass works correctly but has become the slowest stage of the pipeline as log volume has grown.

import java.util.List;
import java.util.regex.Pattern;
import java.util.regex.Matcher;

public class FirewallLogAnalyzer {

    public String analyzePackets(List<String> packets, List<String> blockedIps) {
        String report = "";
        int blockedCount = 0;

        for (int i = 0; i < packets.size(); i++) {
            String packet = packets.get(i);
            String sourceIp = extractIp(packet);

            if (blockedIps.contains(sourceIp)) {
                blockedCount++;
                report = report + "Blocked packet from " + sourceIp + "
";
            }
        }

        return report + "Total blocked: " + blockedCount;
    }

    private String extractIp(String packet) {
        Pattern ipPattern = Pattern.compile("\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}");
        Matcher matcher = ipPattern.matcher(packet);
        if (matcher.find()) {
            return matcher.group();
        }
        return "";
    }
}

Identify what makes this slow at scale and explain how you would rewrite it to run efficiently, without changing what it reports.