System programing and LKM programing is introduced in data sampling in this paper.The design of muti-hiberarchy analyzing engine in paper is a new think for data processing in HIDS.

• 在系统调用分析器的设计中采用了多种分析引擎，分级进行检测，具有提高检测率、减少系统资源消耗的优点。