现在的入侵检测系统大多存在系统可扩展性差、入侵检测技术单一、缺乏对入侵事件有效的响应机制等问题,难以满足企业对入侵检测系统在规模及有效性上的的需求。文章设计了一种大规模分布式入侵检测系统的整体模型,并在系统中综合运用了多种入侵检测方法和响应机制,使整个系统具有好的规模扩展性、高的入侵检测性能和有效的响应机制。 At present, most intrusion detection systems have problems such as poor system scalability, single intrusion detection technology, and lack of effective response mechanisms to intrusion events, which make it difficult to meet the demand of enterprises for the size and effectiveness of intrusion detection systems. This paper designed a large-scale distributed intrusion detection system, the overall model, and the system integrated use of a variety of intrusion detection methods and response mechanisms, the entire system has good scalability, high intrusion detection performance and effective Response mechanism.