The detection principle for such a system is that it flags behavior that is unlikely to originate from normal user activity, without any regard to actual intrusion situational data.

• 对于系统本身检测原则是是标记一个有别于源于其它正常用户活动的标志，跳过实际的入侵数据检测。