The information protections are often used to protect computer system as the first step of defence. Intrusion detection is the second step for secure defence behind firewall, which can monitor network in the precondition of not affecting network performance. Intrusion detection is the whole process that audits, tracks, identifies and detects the unauthorized accesses or abnormal phenomena, actions and events in the system