Network functions such as intrusion detection systems(IDS)have been increasingly deployed as virtual network functions or outsourced to cloud service providers to achieve the scalability and agility and to reduce equipment costs and operational cost.However,virtual intrusion detection systems(VIDS)face more serious security threals due to running in a shared and virtualized environment instead of proprietary devices.Cloud service providers or malicious tenants may illegally access and tamper with the policies of intrusion detection systems,packet information,and internal processing status,thereby violating the privacy and security of tenants networks.To address these challenges,we use Intel SGX to build a Trusted Virtual Intrusion Detection System(TVIDS).For TVIDS,to prevent cloud service providers from accessing sensitive information about the users network,we build a trusted execution environment for security policy,packets processing,and internal state so that cloud service providers and other malicious tenants cant access the protected code,policy,processing states,and packets information of the intrusion detection system.We implemented TVIDS on the basis of the Snort which is famous an open-source IDS,and evaluated its results on real SGX hardware.The results show that our method can protect the security of the virtual IDS and brings the acceptable performance.