Abstract: Feature vectors are abstracted from data describing application processes. The feature vectors are grouped to define non-anomalous clusters of feature vectors corresponding to normal application behavior. Subsequent feature vectors are considered anomalous if they do not fall within one of the non-anomalous clusters; alerts are issued for anomalous feature vectors. In addition, the subsequent feature vectors may be used to regroup feature vectors to adapt to changes in what constitutes normal application behavior.

Abstract: A method for parsing a network message and a communication device, which includes: receiving a network message, where the network message includes one or more sections; identifying that an application protocol type of the network message is a first application protocol; acquiring, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, when the current section is a last section of the network message, the decision result includes a processing method of a next message of the network message.

Abstract: A deep packet inspection method and device, and a coprocessor. The deep packet inspection method includes receiving, by a transceiver module of the coprocessor, an original data packet sent by a general processor, and sending the original data packet to a processor core of the coprocessor; invoking, by the processor core, a sub-coprocessor of the coprocessor to perform application layer parsing on the original data packet so as to obtain an application layer parsing result; and sending, by the processor core, the parsing result to the general processor so that the general processor processes the original data packet according to the parsing result. The deep packet inspection method and device provided by the embodiments of the present disclosure reduce resource occupation of a general processor and increase a running speed.

Abstract: A method for parsing a network message and a communication device are provided. The method includes: receiving a network message, where the network message includes one or more sections; identifying that an application protocol type of the network message is a first application protocol; acquiring, from a current section that is in the network message and that is described by a piece of section description information in a configuration file corresponding to the first application protocol, interesting data indicated by interesting data indication information in the section description information; and executing a decision method in the section description information by using all or a part of the acquired interesting data as a decision condition, thereby obtaining a corresponding decision result, when the current section is a last section of the network message, the decision result includes a processing method of a next message of the network message.