The invention relates to an 
intrusion detection system deployment method, including that: an abnormity monitoring module monitors and identifies an abnormal 
virtual machine; when abnormity is identified, a deployment 
actuator is indicated to locally 
start up and operate an intrusion detection 
virtual machine; the deployment 
actuator acquires an abnormal 
virtual machine mark from the abnormity monitoring module and sets up the connection between a virtual switcher and an intrusion detection virtual 
machine according to the abnormal virtual 
machine mark; and the virtual switcher sends the message sending to or coming from the abnormal virtual 
machine to the intrusion detection virtual machine through a special detection 
virtual network card so as to carry out intrusion detection analysis. The 
intrusion detection system deployment method, based on virtual machine technology, realizes the flexible deployment of the 
intrusion detection system and identifies the abnormal virtual machine by monitoring the abnormity values of the virtual machines so as to pertinently 
start up the intrusion detection virtual machine to conduct intrusion detection to the 
massage transmitted by the intrusion detection virtual machine. The intrusion detection 
system can be deployed more flexibly in a network 
system, thus reducing the intrusion detection load and improves intrusion detection accuracy and efficiency.