With the electronic commerce is going popular, many enterprise turn their business to the internet. The electronic commerce brings many problems on security and the key point is the data of the enterprise and the privacy of the customer. Firewall is not enough and the IDS is needed to provide the acceptable security. With the network monitoring and intrusion detection techniques, we can detect the attacks, alarm the administrators, and write to log files. The log files can be analyzed to provide the prevention to the same types of attacks and protect the security of the system. Recently, some attacks are proposed which can avoid the familiar IDS such as SNORT. The attack will bring a serious damage to the system. We analyze one of these attacks and try to propose a model which can detect it. We believe that the model is useful in the research of the IDS.