In the model,antigen/antibody was classified by consanguinity,the procedure of antigen apoptosis and necrosis were defined,and both danger signal and risk of network were calculated.

To increase the detection ability of unknown intrusion and overcome false negative rate and false positive rate when boundary between normal and abnormal was fuzzy and improve the adaptability of intrusion detection system,a co-stimulate intrusion detection with danger signal based on danger theory was presented.

The paper analyzes the primitive mechanism of the danger theory,according to the features of processing danger signal,an intrusion detection model is presented based on the mathematical statistics matching algorithm which is originated from the HAMMING distance of character string,in order to optimize the method of generating coordinate signal and to operate the matching of antigen and antibody.