A method performed by a network entity for optimizing and configuring a detection rule, comprising: receiving network traffic; extracting a packet from the network traffic, and identifying, according to a feature of the packet, protocol related information used in the network, the protocol related information includes one piece of or a combination of more pieces of following information: a protocol name, an application protocol name, a port number, a server software name, and a server software version; saving the protocol related information and correspondence between pieces of information in the protocol related information to a first learning association table; obtaining a vulnerability rule, which is set corresponding to protocol related information in a vulnerability rule base, according to the identified protocol related information; and integrating the obtained vulnerability rule to generate a first compact rule set when multiple sets of protocol information are identified, wherein the first compact rule set consists of a vulnerability rule that is set corresponding to the identified protocol related information in the vulnerability rule base; before extracting a packet from the network traffic, the method further comprising: setting a learning range, wherein the learning range comprises a network segment or an IP address that is determined in advance; and accordingly, the extracting a packet from the network traffic comprises: extracting, from the network traffic, a packet with a carried address within the learning range. receiving network traffic; extracting a packet from the network traffic, and identifying, according to a feature of the packet, protocol related information used in the network, the protocol related information includes one piece of or a combination of more pieces of following information: a protocol name, an application protocol name, a port number, a server software name, and a server software version; saving the protocol related information and correspondence between pieces of information in the protocol related information to a first learning association table; obtaining a vulnerability rule, which is set corresponding to protocol related information in a vulnerability rule base, according to the identified protocol related information; and integrating the obtained vulnerability rule to generate a first compact rule set when multiple sets of protocol information are identified, wherein the first compact rule set consists of a vulnerability rule that is set corresponding to the identified protocol related information in the vulnerability rule base; before extracting a packet from the network traffic, the method further comprising: setting a learning range, wherein the learning range comprises a network segment or an IP address that is determined in advance; and setting a learning range, wherein the learning range comprises a network segment or an IP address that is determined in advance; and accordingly, the extracting a packet from the network traffic comprises: extracting, from the network traffic, a packet with a carried address within the learning range. extracting, from the network traffic, a packet with a carried address within the learning range.