传统的由安全专家手工构造入侵检测规则的方法在新攻击频繁出现的今天越来越暴露出其工作量大、响应慢的局限性。为克服上述局限,该文提出一种自适应的入侵检测系统框架。该系统基于公共入侵检测框架(CIDF)构建,当出现新攻击时,利用数据挖掘对海量数据进行挖掘,得出入侵模型后由系统自动转换为检测规则以实现规则库的自动更新。另外,在一定授权情况下,其他入侵检测系统可以向该系统请求分发入侵模型以得到及时更新。 Traditional methods of manually constructing intrusion detection rules by security experts expose more and more workloads and slow responses when new attacks frequently occur. In order to overcome these limitations, this paper proposes an adaptive intrusion detection system framework. The system is based on Common Intrusion Detection Framework (CIDF). When a new attack occurs, the system uses data mining to mine the massive data, and then gets the intrusion model and automatically transforms it into detection rules to automatically update the rule base. In addition, under certain authorization, other intrusion detection systems can request the system to distribute the intrusion model for timely updates.