Abstract: With theoretical analysis of protocol analysis and biological immunity system, this paper presents a new intrusion detection model based on protocol analysis and immunological principle. The model can sort the set of detectors according to the protocol type, and generate the relevant subsets of the detectors. Designing a new detector structure can sort the detectors further. The detectors of each subset can mutate, evolve alone and the whole detectors update based on subset. In practical detection, the patterns to be detected match the relevant subset of the detectors, so the detection speed can be effectively improved, making up the deficiency of past modes.

Key words: intrusion detection, immune theory, protocol analysis, subset of detectors