Nowadays security threats behave completely different than it was in the past. Malware hide its presence on target system and try to protect itself from various antivirus software. Most security threats nowadays are not intended to harm victim directly, but utilize the resources that victim provides and controls victim system remotely. Using victim computers to commit further crimes is phenomena of last years which are caused by botnets. There is another type of threats which exploit user trustworthiness and careless, those type often spy user computer and stoles private dates, for example related to banks or credentials to online services. This is done by using various forms of phishing, pharming or using key loggers. It should be noted that even if intrusion detection systems have significantly evolved from main concept, proposed several decades ago, they core remain the same. Thus these solutions hardly reflect the current requirements and available technologies, solutions and knowledge available today. We believe that proposed solution which is presented in fifth chapter is answer to today state. Our approach uses the rapid growth of cloud computing and high speed internet broadband as phenomena of today. We presented more restrictive model of computer security for intrusion detection. We also rely on fact that for almost thirty years that intrusion detection systems exist we have seen all kind of behavior as well as malicious and normal. Thus our system implicitly assumes that everything that is deviated from this behavior, that we already know can be classified as suspicious.