随着各行各业对网络安全的日益重视,入侵检测系统(Intrusion Detection System,简称IDS)得到了广泛的应用。银行、电信、电力等行业都把入侵检测系统作为安全防护的必备措施进行了部署,我国政府更是要求涉密单位必须部署入侵检测系统,以发现来自外部的入侵和来自内部的异常行为并进行预警。但是,随着黑客技术的发展,网络攻击日益呈现集群化、自动化、复合式、快速化等特点。应对这些攻击,传统的IDS能够起到 With all walks of life increasing emphasis on network security, Intrusion Detection System (IDS) has been widely used. In the banking, telecommunications and power industries, intrusion detection systems are deployed as an essential measure for security protection. The government of our country also requires that the units in charge of secrets regulations must deploy intrusion detection systems to detect intrusion from the outside and abnormal behaviors from the inside Early warning. However, with the development of hacker technology, network attacks are increasingly clustered, automated, complex, and fast. To deal with these attacks, the traditional IDS can play