The alert messages can be analyzed in real time,so that the intrusion detection performance of the NIDS is improved and the working intensity of system administrators reduced.