There were a few of researchers proposing realtime intrusion detection systems using different techniques. The first one uses Self-Organizing Map to classify normal data and DoS attack with 10 features of every 50 packets evaluated by different characteristic visualization of normal and DoS [6]. The second one uses Bayesian Classification model to classify normal and attack with first 3 months of training and last month of testing evaluated by detection penalty [7]. The third one uses Adaptive Resonance Theory (ART) and Self-Organizing Map (SOM) by considering about 5000 packets for training and 3000 packets for training, obtaining from sampling during 4-day experiment with 27 features by number of frequency of occurrences in each interval as inputs for classification. The detection rates (Attack and Normal) of the ART and the SOM are about 97% and 95%, respectively [8].