2. The method according to claim 1 , wherein the detection rules comprise protocol rules and attack rules when the method is applied to network intrusion detection field.
2. The method according to claim 1 , wherein the detection rules comprise protocol rules and attack rules when the method is applied to network intrusion detection field. 11. The method according to claim 2 , wherein the parsing table of pushdown automaton comprises an ACTION table and a GOTO table; and an algorithm of the controller comprises the steps of: a) if an input symbol is a terminal symbol, taking an parsing table entry from the ACTION table; if the input symbol is a non-terminal symbol, taking an parsing table entry from the GOTO table; b) if the parsing table entry contains a Shift-Reduce (SR) conflict or a Reduce-Reduce (RR) conflict, copying a state stack so that each state stack has only one action, and then proceeding to step c); c) if the parsing table entry is a reduction action r j , reducing with a production j, subtracting pointers of the state stack and a symbol stack by m which is a number of events on a right-hand side of the production j, and then taking a non-terminal symbol on the right-hand side of the production j as an input symbol; if there is a merged state stack, splitting the merged state stack and then returning to step a); else if the parsing table entry is not a reduction action, proceeding to step d); d) for an input symbol a, besides the symbol a with a corresponding parsing table entry as a Shift action S 0 , if there is at least one predicative symbol, supposing which is a(p 1 ), a(p 2 ), . . . , a(p k ) with corresponding parsing table entries as Shift actions S 1 , S 2 , . . . , S k , checking whether predicates p 1 , p 2 , . . . , p k are true; if at least one of the predicates is true, which means a Shift-Shift conflict occurs, copying the state stack, taking the symbol a and a symbol a(p i ) which meets the predicate p i as input symbols, and then proceeding to step e); and if the parsing table entry corresponding to the symbol a is blank, and there are at least two predicative symbols, supposing which are a(p 1 ), a(p 2 ), . . . , a(p k ) with corresponding parsing table entries as Shift actions S 1 , S 2 , . . . , S k , checking whether predicates p 1 , p 2 , . . . , p k are true; if at least two of the predicates are true, which means a Shift-Shift conflict occurs, copying the state stack, taking symbols a(p i ) which meet the predicates p i as input symbols, and then proceeding to step e); e) else if the parsing table entry is a Shift action S j , shifting the input symbol into the symbol stack and state j into the state stack; if there another state stack with the same stack top state j, merging the two state stacks; furthermore, if a parsing table entry ACTION [j]=r i , that is, the state j is a reducible state, performing a reduction with the production i; if there is a merged state stack, splitting the merged state stack; then returning to step a); if the state j is not a reducible state, terminating the process of the algorithm; f) else if the parsing table entry is a successful action Succ, which means the grammar analysis is successful, terminating the process of the algorithm; and g) else if the parsing table entry is blank, proceeding to an error handing and terminating the process of the algorithm.