Many intrusion detection systems (IDS) rely on protocolspecific analyzers to extract the higherlevel semantic context from a traffic stream. In order to choose the right analyzer, the traditional systems rely on some wellknown ports.Thus, many illegal connections do not use the standard port or use the tunnel technology to evade the intrusion detection system’s testing. In this paper, we hope to achieve a complete reorganization of the data flow to achieve the context of dynamic application protocol analysis so as to detect the intrusion of using unconventional means.