Based on intrusion detection common intrusion detection framework(CIDF) architecture,a new network intrusion detection model of multi-data packages analysis was presented. In this model current affair was transacted by two steps through affair analyzer: F