Abstract: With increase of cyber attack incident and popularization of high speed network，the performance of IDS must be improved.Kruegel applied the ID3 algorithm based on decision-making tree to IDS，which can effectively improve the processing speed of intrusion detection.However，with this method a new decision-making tree must be built each time when rules are appended.Furthermore，it requires too much memory.So it is unfit for real-time applications.In this paper the author introduces the ID5R decision-making tree algorithm based on increment learning and optimize processing of rule attributes to overcome the problems.

摘要： 随着攻击的日益增多和高速网络的普及，对IDS的性能要求也日益提高，Kruegel将ID3决策树引入到入侵检测系统中，有效地提高了入侵检测的速度，但该方法在增加规则时需要完全重建决策树，而且占用内存过大，对于要求实时性的应用场合并不适合。引入基于增量学习的ID5R决策树算法，并对规则属性处理方式进行优化，在保证检测速度的同时解决了实时增加规则和占用内存过大的问题。