通过网络流量信息进行网络入侵检测可以在入侵者未察觉的情况下,检测可能的入侵行为,再搭配其他网络设备对可疑入侵进行阻断,可以保护用户或伺服主机的安全。危险理论作为入侵检测系统架构的核心技术,来提高网络入侵检测的性能。文中分析了基于网络入侵检测的理论基础,以及危险理论在网络入侵检测系统中的应用。 Network intrusion detection based on network traffic information can detect possible intrusion behaviors when the intruder is not aware of it, and then cooperate with other network devices to block suspicious intrusion to protect users or the server. Dangerous theory as the core technology of intrusion detection system architecture to improve the performance of network intrusion detection. The paper analyzes the theoretical basis of network intrusion detection and the application of danger theory in network intrusion detection system.