Abstract: Through analyzing the characteristics and the cooperating mode of the present Distributed Intrusion Detection System (DIDS),this paper proposes a kind of architecture based on Ring Distributed Coordinated Intrusion Detection System （RDCIDS）.Furthermore,it expatiates on the event-generator,and event-analyzer,event-responder of the DIDS;adopts the protocol analysis,the data analysis,command interpreter and cooperate processor.It provides more convenience for the RDCIDS and overcomes the defects such as complicated structure and load imbalance in each subsystem of the present distributed intrusion detection system.

Key words: ring, distributed intrusion detection, system, framework