SRI International's System Design Laboratory has been actively involved in intrusion-detection research since 1983. Our first project, the Intrusion Detection Expert System (IDES), was a rule-based expert system trained to detect known malicious activity. That system was polished and enhanced to form NIDES, the Next-Generation Intrusion Detection Expert System. Currently, our research focuses on EMERALD: Event Monitoring Enabling Responses to Anomalous Live Disturbances, a modern system designed to detect and respond to today's network attacks.