The invention patent relates to a design of a distributed modularized intrusion detection system. The technical scheme is that under a cloud computing environment, an intrusion detection defense assembly is installed on a virtual machine, and the process of an intrusion behavior into the virtual machine is matched with network session data characteristics so that a customized and modularized active intrusion detection defense service is provided for the virtual machine. The beneficial effects of the design of the distributed modularized intrusion detection system are that the requirement for intrusion detection of the virtual machine under the cloud computing environment can be met.