Information systems in recent years have become large-scale and complicated, so it can be said that eradication of vulnerabilities is impossible. The important thing is to always consider the situation where the attack will succeed even if it is unlikely, and it is necessary to design the system assuming the existence of the vulnerability. Intrusion detection and prevention is an important elemental technology that forms the basis of this.