Abstract: In this paper the case-based reasoning （CBR） is introduced to reduce the false negative rate caused by rulebased precise matching in intrusion detection system and to detect the variation of known attack. The steps of implementing CBR are described, sever

Key words: Intrusion detection, Rule, Case-based reasoning, Snort