Abstract: A Data Leakage Prevention (DLP) device and a method for processing a packet are disclosed. The DLP device receives an IP packet sent by a user device, wherein the IP packet includes TCP port information; and detects whether a first TCP connection is established between the DLP device and the user device. If the first TCP connection is not established, when the IP packet is a data packet, an application layer protocol for transmitting the IP packet is determined by comparing a packet feature of the IP packet with packet features corresponding to respective application layer protocols. When the application layer protocol for transmitting the IP packet is listened to, a pair of TCP connections is established according to the TCP port information, wherein the pair of TCP connections includes the first TCP connection and a second TCP connection between the DLP device and a server.

Abstract: User behavior data of multiple users is acquired, and multiple user eigenvalues of user behavior data of each user under preset multiple user behavior dimensions are extracted. A user eigenvector of each user is determined based on the multiple eigenvalues of this user. Multiple user classes are obtained by clustering the user eigenvectors of multiple users are clustered through a preset clustering algorithm. A central vector of each user class is determined based on the user eigenvectors included in this user class. A difference eigenvector of each user class is determined, wherein a distance between the difference eigenvector and a central vector of an aggregation class to which the difference eigenvector belongs is not within a preset distance range. A user characterized by the difference eigenvector is determined as an abnormal user.

Abstract: A method and apparatus for establishing a fast-forwarding table are provided. The method comprises: when a communication packet is received, determining, according to matching rules of services set in a packet processing policy, a target service matching the communication packet; if a fast-forwarding table corresponding to the communication packet is not stored locally, obtaining a preset target priority of the target service, and determining a target resource utilization threshold corresponding to the target priority according to a preset correspondence between priorities and resource utilization thresholds; determining whether a current resource utilization is greater than the target resource utilization threshold; and establishing a fast-forwarding table corresponding to the communication packet if the current resource utilization is not greater than the target resource utilization threshold.

Abstract: A domain name resolution request sent by a terminal is received. The domain name resolution request includes a domain name to be identified. The domain name includes at least one character. A sequence matrix corresponding to the domain name is determined. The sequence matrix includes at least one character vector. Each of the at least one character vector corresponds to each of the at least one character one to one. Each of the at least one character vector is sequentially input to an input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. A feature vector corresponding to the sequence matrix is obtained by performing logical operation processing on each of the at least one character vector based on the logical operation rule between the plurality of activation functions.