摘要：【中文】本发明实施例提供一种入侵防御规则动态调整方法及装置，所述方法包括：获取主机当前开启的网络服务端口，根据主机当前开启的网络服务端口，获取每种网络服务端口下开启的子服务端口，并根据每种网络服务端口下开启的子服务端口，加载与所述开启的子服务端口匹配的IPS防护规则。本发明实施例由于根据主机当前开启的网络服务端口以及根据每种网络服务端口下开启的子服务端口，加载与开启的子服务端口匹配的IPS防护规则，从而能够只加载跟主机当前开启的网络服务匹配的IPS防护规则，而不必加载全部的IPS防护规则，从而可以解决IPS进程启动慢以及启动持续占用CPU内存高的问题，进而可以加快数据包匹配速度。 【EN】The embodiment of the invention provides a method and a device for dynamically adjusting intrusion prevention rules, wherein the method comprises the following steps: the method comprises the steps of obtaining a network service port currently opened by a host, obtaining sub-service ports opened under each type of network service port according to the network service port currently opened by the host, and loading IPS protection rules matched with the opened sub-service ports according to the sub-service ports opened under each type of network service port. According to the embodiment of the invention, the IPS protection rule matched with the opened sub-service port is loaded according to the network service port opened by the host computer at present and the sub-service port opened under each network service port, so that only the IPS protection rule matched with the network service opened by the host computer at present can be loaded, and all IPS protection rules do not need to be loaded, thereby solving the problems that the IPS process is slow to start and the CPU memory is high in continuous occupation during starting, and further accelerating the data packet matching speed.