Protect: It drops the packets with an unknown source address. It does so until you delete a sufficient number of secure MAC addresses.
Restrict: It drops the packets with foreign/unknown source addresses until you get rid of a sufficient number of secure MAC addresses to drop below the maximum value. It then causes the SecurityViolation counter to increase.
Shutdown: It causes the interface to enter an error-disabled state immediately. It then sends an SNMP trap notification.