Attacks in network have caused a variety of serious problems, but intrusion detection in network is still an immature technology. And it is very important for network security to timely detect anomalies and rapidly response. Many intrusion detection methods have been proposed from simple to sophisticated techniques in the literature. Among them, the Context-Based Intrusion Detection (CBID) algorithm is an excellent. However, the CBID method just relying on personal experience but not a clear way
