The decision tree is an effective classification method in data mining. Using this method, the intrusion detection system can be more accurate and efficient to process network data. However, faced with a large network data set, the scale of decision tree is often complex and hard to understand. This paper presents a multi-strategy pruning algorithm to trim the tree. This method can improve the efficiency and accuracy of intrusion detection system.

In the case of network applications become more common and computer network security issues become more prominent, intercepting and analyzing network packets is important. However, network environment traffic is large. How to intercept and analyze network packet effectively is a crucial issue. This paper research the process of NDIS intermediate driver capture packets in the Windows platform and propose a mode of shared memory blocks that transport data packets to the application layer software to analyze. This way can improve the efficiency of communication between kernel layer and application layer and reduce the probability of losses during the packets transmission.