Based on this model, this paper presents a few mechanisms in the real-time alert system implemented in SecLinux and improves the storing and matching methods of normal databases.

• 根据此模型，在安全操作系统审计子系统的基础上，实现了安全操作系统的实时报警系统，并对正常库的存储及匹配方法进行了改进。