Abstract: With the ceaseless developing of the computer network environment and strengthening of network application, it becomes more and more difficult to analyze protocol and detect intrusion. In addition, report mistakes and pretermission happen frequently. The reliability of protocol analysis and intrusion detection can be improved greatly by identifying applicationlevel protocol and analyzing different protocols with different methods before protocol analysis and intrusion detection. A generalpurpose applicationlevel protocol identification technology is proposed and applied to an intrusion detection system, whose usability and reliability are proved by the experimentation.

Key words: intrusion detection, multipattern match , protocol identification