The invention relates to an
intrusion detection system deployment method, including that: an abnormity monitoring module monitors and identifies an abnormal
virtual machine; when abnormity is identified, a deployment
actuator is indicated to locally
start up and operate an intrusion detection
virtual machine; the deployment
actuator acquires an abnormal
virtual machine mark from the abnormity monitoring module and sets up the connection between a virtual switcher and an intrusion detection virtual
machine according to the abnormal virtual
machine mark; and the virtual switcher sends the message sending to or coming from the abnormal virtual
machine to the intrusion detection virtual machine through a special detection
virtual network card so as to carry out intrusion detection analysis. The
intrusion detection system deployment method, based on virtual machine technology, realizes the flexible deployment of the
intrusion detection system and identifies the abnormal virtual machine by monitoring the abnormity values of the virtual machines so as to pertinently
start up the intrusion detection virtual machine to conduct intrusion detection to the
massage transmitted by the intrusion detection virtual machine. The intrusion detection
system can be deployed more flexibly in a network
system, thus reducing the intrusion detection load and improves intrusion detection accuracy and efficiency.