Abstract: When lots of alerts are simultaneously presented to the administrator，the decisions are made according to the network attack severity，network attack classification and attack effect.But these concepts do not consider the response opportunity，the sequence of the invasion happening and so on.It only reflects the static information.Based on the status quo，the conception of Alert Urgent Degree（AUD） is proposed.This conception considers the following factors for the first time：（1）the trustworthy degree and the frequency of the alert.（2）the elapsed time from the beginning of alert.（3）the cost of responding to the intrusion.Furthermore，the direct factors which affect the AUD are considered and the indirect factors which relate the intrusion are introduced also.Lastly，based on the illation of mathematic，this paper presents the model of AUD.

Key words: Alert Urgent-Degree（AUD）, Intrusion Detection Systems（IDS）, alert, network attack severity, modeling

摘要： 当多个IDS的检测代理同时提交入侵警报时，现有的决策依据主要是警报危害度、网络攻击分类、攻击效果评价等，但这些概念并没有考虑响应时机和入侵发生的先后时间等因素，而只反映了静态信息。针对这种现状，首先提出了警报危急度的概念，警报危急度综合考虑了以下因素：（1）警报的可信度与报警的次数；（2）开始报警到目前的已逝去时间；（3）响应该入侵需要的代价。然后，分析了影响危急度的直接因素及其影响的方式和幅度，以及与攻击有关的间接因素及其影响程度；最后，文章基于数学推理，给出了警报危急度的数学模型。

关键词: 危急度, 入侵检测系统, 警报, 网络攻击, 模型